OpenTravel Alliance · Domain Security

Opentravel Alliance Domain Security

Domain security

Domain security posture for OpenTravel Alliance, probed live across 4 host(s) and 3 registrable domain(s). 3 host(s) serve HTTPS (up to TLSv1.3); 1 advertise HSTS. Email/DNS controls: DNSSEC absent, SPF present, DMARC absent.

TravelUnited StatesStandardsAviationHospitalityHotelsCar RentalRailCruiseDistributionGDSBookingChannelXMLJSON-Schema

Transport & Host Security

opentravel.org
HTTPS: yes · TLS: TLSv1.3 · HSTS: yes · cert expires: Sep 9 21:25:29 2026 GMT
www.opentraveldevelopersnetwork.com
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Sep 21 08:46:49 2026 GMT
opentravelmodel.net
HTTPS: yes · TLS: TLSv1.3 · HSTS: no · cert expires: Oct 17 16:01:04 2026 GMT
127.0.0.1
HTTPS: no · HSTS: no

Domain (DNS/Email) Security

opentravel.org
DNSSEC: no · SPF: yes · DMARC: no · CAA: none
opentraveldevelopersnetwork.com
DNSSEC: no · SPF: no · DMARC: no · CAA: none
opentravelmodel.net
DNSSEC: no · SPF: yes · DMARC: no · CAA: none

Source

Domain Security

Raw ↑ 
generated: '2026-07-28'
method: probed
source: >-
  live DNS/TLS/HTTP probes of every apis.yml host and every OpenAPI servers[] host
  (0-working/probe-domain-security.py, plus manual openssl/dig probes of the two OpenTravel-run
  service hosts the automated pass did not reach)
hosts:
- host: opentravel.org
  role: main website, MCP server, OAuth 2.1 authorization server
  https: true
  tls_version: TLSv1.3
  cert_expires: Sep  9 21:25:29 2026 GMT
  hsts: true
  hsts_max_age: 63072000
- host: www.opentraveldevelopersnetwork.com
  role: OpenTravel Developers Network (ODN) developer portal
  https: true
  tls_version: TLSv1.3
  cert_issuer: "Let's Encrypt (CN=YR1)"
  cert_expires: Sep 21 08:46:49 2026 GMT
  hsts: false
- host: opentravelmodel.net
  role: OTM Library Repository console
  https: true
  tls_version: TLSv1.3
  cert_issuer: GlobalSign GCC R6 AlphaSSL CA 2025
  cert_expires: Oct 17 16:01:04 2026 GMT
  hsts: false
- host: 127.0.0.1
  role: placeholder host declared by the published Swagger 2.0 contracts
  https: false
  note: >-
    Not a real host. Six of the eight published documents declare host 127.0.0.1 and two declare
    example.com, and every one declares `schemes: [http]`. Implementers must supply their own
    host and serve over HTTPS; the artifact does not say so.
domains:
- domain: opentravel.org
  dnssec: false
  caa: []
  spf: true
  dmarc: false
- domain: opentraveldevelopersnetwork.com
  dnssec: false
  caa: []
  spf: false
  dmarc: false
- domain: opentravelmodel.net
  dnssec: false
  caa: []
  spf: true
  spf_record: 'v=spf1 ip4:3.135.211.37 +a +mx ~all'
  dmarc: false
observations:
- >-
  All three OpenTravel-operated hosts negotiate TLS 1.3 with valid certificates.
- >-
  HSTS is set only on opentravel.org (max-age 63072000, two years). Neither the developer portal
  nor the OTM repository console — both of which take a username and password — sends it.
- >-
  No domain publishes DNSSEC or a CAA record.
- >-
  No domain publishes DMARC, so there is no policy on mail spoofing opentravel.org,
  opentraveldevelopersnetwork.com or opentravelmodel.net. opentravel.org and opentravelmodel.net
  publish SPF; opentraveldevelopersnetwork.com publishes neither.
vulnerability_disclosure:
  published: false
  probed: '2026-07-28'
  detail: >-
    No vulnerability disclosure program and no trust center exist. /.well-known/security.txt
    returns a real nginx 404 on both opentravel.org and opentraveldevelopersnetwork.com.
    /security/, /responsible-disclosure/, /vulnerability-disclosure/, /trust/ and /compliance/
    on opentravel.org all return the WordPress soft-404 homepage (identical 190,291-byte body,
    zero disclosure or certification keywords). trust.opentravel.org and security.opentravel.org
    do not resolve. No HackerOne, Bugcrowd or Intigriti program was found. No SOC 2, ISO 27001,
    PCI DSS, HIPAA or FedRAMP claim appears anywhere on the site. Recorded as a verified
    negative — no security/ vulnerability-disclosure or trust-center artifact was written,
    because there is nothing to record.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this
  • find_securityBrowse and filter every security artifact in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This security artifact 
curl "https://apis.io/api/v1/security/opentravel-alliance-domain-security"
All security posture 
curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.