4 ms·
Basically, their web ui and underlying service both allow retrieving an itinerary if you have the PNR record locator (a string like "W862MY") and either a last
by tyingq 5y ago
Basically, their web ui and underlying service both allow retrieving an itinerary if you have the PNR record locator (a string like "W862MY") and either a last name, or an email address. The api call is apparently returning the phone number and other data.
You can argue whether that's a good idea, but it doesn't appear to be a bug or mistake. It's by design.
- isbvhodnvemrwvn 5y ago1970s or 1980s design, pretty much all PNRs can be accessed by that, regardless of the air line.
- tyingq 5y agoI don't think it's old design myself. I think it's "how little can we require so that people don't call on the telephone or get in line at the airport?" Any barrier you put in front of them increases support calls or slows down the check-in line. Airline websites have logins, passwords, resets, and so on. They just don't want to make that a requirement to get a boarding pass, etc.
- isbvhodnvemrwvn 5y agoPNRs are not maintained by airlines themselves, they use GDS like Amadeus or Sabre to do that. They still go through mainframes.
- tyingq 5y ago>PNRs are not maintained by airlines themselves This isn't correct. You can have a PNR in a GDS, but you don't have to. The airline has their own central reservation system with the authoritative PNR. The CRS may be provided by Sabre, Amadeus, etc, but it's not a GDS...that's separate. >They still go through mainframes Some have moved entirely off of TPF mainframes. Amadeus/Altea is one example.