Confirm Booking

Confirm Booking

put

Completes the second step of the two-step booking flow. Use this endpoint after confirming an Offer with require_payment_confirmation set to true, which leaves the booking in PENDING_PAYMENT. Once payment has been collected, call this endpoint to move the booking to CONFIRMED and issue the policies. The booking must be in PENDING_PAYMENT status; any other status returns 422.

Idempotency

This endpoint supports idempotency keys via the x-idempotency-key header to prevent duplicate transactions. Provide a unique operation identifier (e.g., UUID) to ensure safe retries. Duplicate requests return:

• 409 Conflict: The request was already processed; response contains the cached original result (handle as success)
• 423 Locked: The original request is still processing; retry after a short delay

Authorizations

AuthorizationstringRequired

Composite Authentication Scheme (Client Key, Date, and Signature)

This scheme requires the client to provide three mandatory headers in every request:

1. X-Api-Key (Client Key)

• Purpose: Public identifier for the API consumer.
• Example: X-Api-Key: YOUR_API_KEY_HERE

2. Date (Timestamp)

• Purpose: Timestamp used for generating the signature and preventing replay attacks.
• Format: RFC 7231 format (e.g., in GMT).
• Example: Date: Sun, 09 Nov 2025 04:04:00 GMT

3. Authorization (Computed Signature)

• Purpose: The cryptographic signature that verifies the request's authenticity and integrity.
• Format: SIGNATURE [authHeader]

Signature Generation Logic: The authHeader value is derived from a cryptographic hash (e.g., HMAC-SHA256) of canonical request components (HTTP Method, Path, and the contents of the Date header), signed with the private Client Secret.

Path parameters

partner_codestringRequired

Partner code identifier. Client Solutions Engineer (CSE) should provide this value.

booking_idstringRequired

The booking ID (INS number) returned from the Confirm Offer endpoint.

Header parameters

x-idempotency-keystring · uuidOptional

A unique identifier to ensure idempotent request processing. If a request with the same idempotency key and body has already been processed, the cached response is returned with a 409 Conflict status code (which can be treated as successful). Keys are stored for 48 hours.

Example: 550e8400-e29b-41d4-a716-446655440000

Body

xpay_charge_idstringOptionalDeprecated

Deprecated. Use payment_details.xpay_charge_id instead.

Responses

201

Created

application/json

The confirmed booking. Payload is identical to the Confirm Offer response.

idstringOptional

statusstringOptional

currencystringOptional

total_pricenumberOptional

total_price_formattedstringOptional

partner_transaction_idany · nullableOptional

created_atstring · date-timeOptional

updated_atstring · date-timeOptional

pds_urlstring · uriOptional

security_tokenstringOptional

account_urlstring · uriOptional

sign_up_urlstring · uriOptional

policyholderobjectOptional

total_taxnumberOptional

total_tax_formattedstringOptional

total_premiumnumberOptional

total_premium_formattedstringOptional

fnol_linkstring · uriOptional

booking_agentany · nullableOptional

404

Not Found

application/json

409

Conflict - Duplicate Request (Idempotent)

application/json

422

Unprocessable Entity

application/json

423

Locked - Request In Progress

application/json

put/partners/{partner_code}/bookings/{booking_id}/confirm

PUT /x/partners/{partner_code}/bookings/{booking_id}/confirm HTTP/1.1
Host: api.xcover.com
Authorization: YOUR_API_KEY
Content-Type: application/json
Accept: */*
Content-Length: 140

{
  "payment_details": {
    "provider": "text",
    "transaction_id": "text",
    "xpay_charge_id": "text",
    "xpay_customer_id": "text",
    "customer_token_id": "text"
  }
}

{
  "id": "text",
  "status": "text",
  "currency": "text",
  "total_price": 1,
  "total_price_formatted": "text",
  "partner_transaction_id": null,
  "created_at": "2026-01-01T00:00:00.000Z",
  "updated_at": "2026-01-01T00:00:00.000Z",
  "pds_url": "https://example.com",
  "security_token": "text",
  "quotes": [
    {
      "id": "text",
      "policy_start_date": "2026-01-01T00:00:00.000Z",
      "policy_end_date": "2026-01-01T00:00:00.000Z",
      "status": "text",
      "price": 1,
      "price_formatted": "text",
      "insured": [
        {}
      ],
      "can_be_cancelled": true
    }
  ],
  "coi": {
    "url": "https://example.com",
    "pdf": "https://example.com"
  },
  "account_url": "https://example.com",
  "sign_up_url": "https://example.com",
  "policyholder": {},
  "total_tax": 1,
  "total_tax_formatted": "text",
  "total_premium": 1,
  "total_premium_formatted": "text",
  "fnol_link": "https://example.com",
  "booking_agent": null
}