How to use this API
1. Get credentials
Contact the APIM team (EXCHANGESYSTEMS.API@accor.com) to:
- Get an App created on the Developer Portal for your partner.
- Get the App's ApiKey (
x-api-keyheader). - Get a JWT (Bearer token, HS512) from the Loyalty team for the
ROLE_SUBSCRIPTION_PLANS_READ/ROLE_SUBSCRIPTION_PLANS_WRITEroles.
Your partner code (ACCOR_PLUS, AMEX, …) will be configured by the APIM
team as a custom attribute partnerCode on your App. You never send it
yourself.
2. Base URLs (CI-v2)
| Environment | Base URL |
|---|---|
| DEV | https://dev-api.accor.com/loyalty/v1/subscription-plans |
| REC | https://rec-api.accorhotels.com/loyalty/v1/subscription-plans |
| PRE-PROD | https://pre-api.accor.com/loyalty/v1/subscription-plans |
| PROD | https://api.accor.com/loyalty/v1/subscription-plans |
The legacy CI-v1 proxy is still reachable on
/loyalty/v1/subscription/plans(same backend, different gateway path).
3. Example — list active plans
curl -X GET "https://rec-api.accorhotels.com/loyalty/v1/subscription-plans/plans" \
-H "x-api-key: <YOUR_API_KEY>" \
-H "Authorization: Bearer <YOUR_JWT>"
The gateway automatically adds X-Partner-Code: <your-partner> before
forwarding to the backend. Only plans for your partner are returned.
4. Example — create a plan
curl -X POST "https://rec-api.accorhotels.com/loyalty/v1/subscription-plans/plans" \
-H "x-api-key: <YOUR_API_KEY>" \
-H "Authorization: Bearer <YOUR_JWT>" \
-H "Content-Type: application/json" \
-d '{
"subscriptionCode": "AMERICAN_EXPRESS_INDIA",
"plan": "Platinum",
"action": "New",
"active": true,
"productCode": "3086167",
"subscriptionAdvantages": {
"statusNights": 30,
"stayPlus": 3,
"rewardPoints": 450
}
}'
5. Example — patch a plan
action and productCode are query parameters — both are part of the
composite business key.
curl -X PATCH \
"https://rec-api.accorhotels.com/loyalty/v1/subscription-plans/plans/AMERICAN_EXPRESS_INDIA/Platinum?action=New&productCode=3086167" \
-H "x-api-key: <YOUR_API_KEY>" \
-H "Authorization: Bearer <YOUR_JWT>" \
-H "Content-Type: application/json" \
-d '{"active": false}'
6. Troubleshooting
| HTTP | Likely cause |
|---|---|
401 Unauthorized |
JWT missing, expired, or wrong signature |
403 IPDeniedAccess |
Your source IP is not whitelisted (preprod/prod only) |
403 Forbidden |
JWT valid but role insufficient |
400 on GET |
X-Partner-Code not injected → App missing partnerCode attribute |