Authentication

All requests from Travel Curious to the Operator Booking System will be made over an HTTPS connection. The OBS API server must present a valid SSL certificate; Travel Curious will not accept self-signed SSL certificates.

Clients must authenticate their requests to the OBS using basic HTTP authentication (outlined in RFC 7235). The OBS must ensure that valid responses are only returned to authenticated clients; any unauthenticated or unauthorized requests should receive an HTTP 401 error code.