JDB Mini App Product Types

Returns the product types available for booking through the JDB Mini App. Use each product's key as orderInfo.orderType when registering an order with JDB.

Endpoint: /api/v1/jdb-min-app/product-types
Method: POST
Authentication: Partner-Access-Token.

This endpoint can be called before Provider Login. It does not require a user Bearer token or issue a login token. The response contains the same supported product list for every authenticated partner; it is not filtered by the partner's enabled products.

Request Headers

Header	Type	Required	Description
`Partner-Access-Token`	Base64 String	Yes	Partner B2B token. See Partner Access Token for generation and validity rules.
`Content-Type`	String	Yes	`application/json`.
`Accept`	String	Yes	`application/json`.
`X-Request-Signature`	String	Optional	Base64URL-encoded RSA-SHA256 signature, without padding.
`X-Nonce-Id`	String	Required when signing	Nonce used to construct the signed content, e.g. `a37f219c05ee8144`.
`X-Request-Time`	String	Required when signing	ISO 8601 timestamp with timezone offset, e.g. `2026-10-28T12:00:00+07:00`.

The partner token is required even when an RSA signature is supplied. Requests without X-Request-Signature are accepted. When a non-empty signature is supplied, the server verifies it against the configured JDB public key. If that public key is not configured, signature verification is skipped.

Request Body

No body parameters are required. Send an empty JSON object:

{}

Example Request

Replace the base URL and token with your integration values:

curl --request POST 'https://api.example.com/api/v1/jdb-min-app/product-types' \
  --header 'Partner-Access-Token: YOUR_PARTNER_ACCESS_TOKEN' \
  --header 'Content-Type: application/json' \
  --header 'Accept: application/json' \
  --data-raw '{}'

Request Signature

Signed requests follow the same RSA-SHA256 specification as Provider Login, using this endpoint's actual request URI:

<HTTP-METHOD> <Request-URI>
<X-Nonce-Id>.<X-Request-Time>.<Request-Body>

For example, with the exact request body {}:

POST /api/v1/jdb-min-app/product-types
a37f219c05ee8144.2026-10-28T12:00:00+07:00.{}

Separate the two lines with one newline (\n). Sign the UTF-8 content using the client RSA private key with SHA-256, then Base64URL-encode the signature without padding (+ → -, / → _, remove trailing =). Send it as X-Request-Signature, together with the nonce and timestamp used above.

Sign the exact raw JSON bytes sent in the request, including whitespace. The request URI includes the /api/v1 prefix and any query string; do not sign the Provider Login URI for this request.

Success Response (HTTP 200)

{
  "result": {
    "resultStatus": "S",
    "resultCode": "SUCCESS",
    "resultMessage": "Success"
  },
  "productTypes": [
    {
      "key": "AIRPORT_TRANSFER",
      "name": "Airport Transfer"
    },
    {
      "key": "MORE_EXPERIENCE",
      "name": "More Experience"
    },
    {
      "key": "FLIGHT",
      "name": "Flight"
    },
    {
      "key": "HOTEL",
      "name": "Hotel"
    },
    {
      "key": "TOUR_PACKAGES",
      "name": "Tour Packages"
    }
  ]
}

Response Fields

Field	Type	Description
`result.resultStatus`	String	`S` for success, `F` for failure.
`result.resultCode`	String	`SUCCESS` or `INVALID_SIGNATURE` for responses from this endpoint's controller.
`result.resultMessage`	String	Human-readable result message.
`productTypes`	Array of Objects	Supported JDB product types. Present on success.
`productTypes[].key`	String	Value to send as `orderInfo.orderType` when registering a JDB order.
`productTypes[].name`	String	Human-readable product name.

Supported Product Types

Key (`orderInfo.orderType`)	Name
`AIRPORT_TRANSFER`	Airport Transfer
`MORE_EXPERIENCE`	More Experience
`FLIGHT`	Flight
`HOTEL`	Hotel
`TOUR_PACKAGES`	Tour Packages

Airport VIP Assistance is excluded from the JDB Mini App product list. Use the returned keys exactly, including uppercase letters and underscores.

Response Headers and Signature

Success and invalid-signature responses include:

Header	Description
`Content-Type`	`application/json`.
`X-Nonce-Id`	Server-generated 16-character hexadecimal nonce.
`X-Response-Time`	Server ISO 8601 timestamp with timezone offset.
`X-Response-Signature`	Base64URL-encoded RSA-SHA256 signature, included only when server response signing succeeds.

To verify X-Response-Signature, use the server's RSA public key and the following content, preserving the exact response body bytes:

POST /api/v1/jdb-min-app/product-types
<X-Nonce-Id>.<X-Response-Time>.<Response-Body>

Use the actual request URI, including any query string. If the server private key is unavailable or signing fails, the response is still returned without X-Response-Signature.

Error Responses

Invalid Signature (HTTP 200)

Returned when the supplied request signature fails verification:

{
  "result": {
    "resultStatus": "F",
    "resultCode": "INVALID_SIGNATURE",
    "resultMessage": "The signature is invalid"
  }
}

Check result.resultStatus and result.resultCode even when the HTTP status is 200.

Missing or Invalid Partner Token (HTTP 401)

Partner authentication runs before signature verification. A missing token returns:

{
  "error": "Partner-Access-Token header is required"
}

Invalid or expired tokens also return HTTP 401 with an error message, such as Invalid token structure, Invalid API Key, Invalid token signature, or Token has expired. See Partner Access Token for the full list.

These middleware errors use the error format above rather than the JDB result envelope and do not include the JDB response signature headers.

Request Headers​

Request Body​

Example Request​

Request Signature​

Success Response (HTTP 200)​

Response Fields​

Supported Product Types​

Response Headers and Signature​

Error Responses​

Invalid Signature (HTTP 200)​

Missing or Invalid Partner Token (HTTP 401)​