Loyalty Bulk Orders (APIM CI-v2)

This API exposes the AAB bulk order (bulk sale) journey of the Accor loyalty platform. A company administrator orders subscription cards for several of its employees, for a single product (Explorer, ibis or Voyageur), settled by a single aggregated payment.

Note: This is an independent APIM CI-v2 publication (BasePath /loyalty/v1/bulk-orders). It is distinct from Loyalty Subscription Plans Matrix (/loyalty/v1/subscription-plans): different functional domain, different consumers, different roles, independent lifecycle. Both publications target the same backend host under different gateway paths.

Endpoints

PATCH /bulk-order is proxied on the same BasePath and the same backend route as POST and GET. The caller sends the functional bulkOrderId returned by POST /bulk-order and a paymentResult (PAID, FAILED or EXPIRED). The gateway injects no extra header.

Security

• JWT (Bearer, HS512) validated by the backend.
  • POST /bulk-order: ROLE_SUBSCRIPTION_PAYMENT or ROLE_PARTICIPANT.
  • PATCH /bulk-order: ROLE_SUBSCRIPTION_PAYMENT or ROLE_PARTICIPANT.
  • GET /bulk-order/{bulkOrderId}: ROLE_SUBSCRIPTION_GETINFO or ROLE_PARTICIPANT.
• ApiKey on the App, to identify the caller.
• IP whitelisting enabled on preprod and prod.

Notes

• POST /bulk-order returns HTTP 200 (not 201); the body carries the functional bulkOrderId and the redirectPayment link.
• PATCH /bulk-order returns HTTP 200. The body carries bulkOrderId, the status applied synchronously, and the paymentResult that was applied.
  • PAID sets the global status to PAYMENT_DONE and starts asynchronous card crediting. A second PAID while the sale is already PAYMENT_DONE is accepted and resumes crediting.
  • FAILED or EXPIRED sets the global status to PAYMENT_FAILED and credits no card.
  • Per-member results are not in this response. Read them afterwards with GET /bulk-order/{bulkOrderId}.
• The internal technical identifier (bulkSaleId) and the transient payment link are never exposed by GET /bulk-order/{bulkOrderId}.
• Quantity is derived from the employee list (one employee = one card in the MVP).