Loyalty Subscription Plans API (APIM CI-v2)
This API exposes the Subscription Plan Matrix of the Accor loyalty platform. It allows partners (Accor+, American Express, …) to consult and manage the subscription plans they are entitled to configure.
Note: This is the APIM CI-v2 publication (BasePath
/loyalty/v1/subscription-plans). A legacy CI-v1 proxy is still available on/loyalty/v1/subscription, exposing the same backend. Both remain active in parallel.
Endpoints
| Method | Path | Description |
|---|---|---|
GET |
/plans |
Get active subscription plan matrix (filtered by the calling partner) |
POST |
/plans |
Create a new subscription plan configuration |
PATCH |
/plans/{subscriptionCode}/{plan} |
Partially update a subscription plan configuration |
Partner scoping — how it works
Every call is scoped to a single partner. The partner is not provided by
the consumer; it is injected by the APIM gateway into the X-Partner-Code
HTTP header, based on the calling App's custom attribute partnerCode.
- Consumer calls
GET /planswith only its ApiKey and JWT. - Gateway reads the App attribute
partnerCode(e.g.ACCOR_PLUS). - Gateway forwards the request to the backend with
X-Partner-Code: ACCOR_PLUS. - Backend applies the partner filter on its side.
This means the consumer never has to send X-Partner-Code itself — it cannot
spoof another partner.
Security
- JWT (Bearer, HS512) validated by the backend (
ROLE_SUBSCRIPTION_PLANS_READ,ROLE_SUBSCRIPTION_PLANS_WRITE). - ApiKey on the App, to identify the partner and pick the correct
partnerCodecustom attribute. - IP whitelisting enabled on preprod and prod.