Postman collection

A ready-to-use Postman v2.1 collection covers the three gateways: Brave (JSON/XML), OS-Travel and Cyberesa.

Setup

1. Postman → Import → select brave-partner-gateway.postman_collection.json.
2. Open the collection variables and fill in your real credentials.
3. Run Ping: the pre-request script automatically computes X-Timestamp and X-Signature.

Variables

Pre-request script (Brave gateway folder)

The script computes the signature for every request in the folder — the same computation as in the Request signing guide:

// v2 scheme (security review #1): HMAC(method + path + timestamp + sha256(body), derived key)
const crypto = require('crypto-js')
const apiKey = pm.collectionVariables.get('api_key')
const signingKey = crypto.SHA256('sig-v2|' + pm.collectionVariables.get('api_secret')).toString()
const timestamp = Math.floor(Date.now() / 1000).toString()
// Path as sent, query string included
const url = pm.request.url
let path = url.getPath()
const query = url.query ? url.query.toString() : ''
if (query) path += '?' + query
// Exact raw body (empty string when no body)
const body = (pm.request.body && pm.request.body.raw) || ''
const bodyHash = crypto.SHA256(body).toString()
const payload = pm.request.method.toUpperCase() + '\n' + path + '\n' + timestamp + '\n' + bodyHash
const signature = crypto.HmacSHA256(payload, signingKey).toString()
pm.collectionVariables.set('timestamp', timestamp)
pm.collectionVariables.set('signature', signature)

Collection contents

• Brave gateway — ping, hotels, hotel detail, reference data, availability (city and hotel list), checkrate, booking creation, clientReference duplicate, detail, list, cancellation simulation, cancellation, voucher — each request in JSON and XML variants.
• OS-Travel — ListCountry, ListCity, ListBoarding, ListCategorie, ListCurrency, ListHotel, HotelDetail, HotelSearch, BookingCreation (PreBooking), BookingList, BookingDetail, BookingCancellation (PreCancelled).
• Cyberesa — HotelSearchREQ, HotelQuoteREQ, HotelBookingCreationREQ, HotelBookingCancellationREQ, StaticDataRQ (form-url-encoded strRQ bodies).