Virgin Atlantic Authentication

generated: '2026-07-28'
method: searched
source: >-
  https://ndc.virginatlantic.com/help/how-to-start-your-build,
  https://ndc.virginatlantic.com/help/how-to-access-ndc-apis,
  https://ndc.virginatlantic.com/certification,
  https://ndc.virginatlantic.com/docs/orderchangenotif
docs: https://ndc.virginatlantic.com/help/how-to-start-your-build
description: >-
  Virgin Atlantic's NDC API authenticates with a single API key carried in an HTTP header. There is
  no OAuth 2.0, no OpenID Connect, no mTLS and no signed-request scheme published anywhere on VS NDC
  Connect, and no OpenAPI exists from which securitySchemes could be derived - this profile is read
  directly from the published build documentation. The header name and the Azure Front Door DNS for
  ndc.virginatlantic.com indicate the gateway is Microsoft Azure API Management.
summary:
  types: [apiKey]
  api_key_in: [header]
  oauth2_flows: []
  oidc: false
  mutual_tls: false
schemes:
  - name: VSNDCApiKey
    type: apiKey
    in: header
    parameter_name: Ocp-Apim-Subscription-Key
    example_header: 'Ocp-Apim-Subscription-Key: [API-KEY-VALUE]'
    verbatim: >-
      "The HTTP header must include your API Client Key to grant access to the API. This would have
      been provided to you as part of the NDC API Access process."
    gateway: Microsoft Azure API Management (inferred from the Ocp-Apim-Subscription-Key header name
      and the avahfrontdoorprod.azurefd.net Azure Front Door DNS)
    environments: [Test, Production]
    failure_code: '111 - Invalid Agent''s IATA API Key'
    sources: [https://ndc.virginatlantic.com/help/how-to-start-your-build]
request_headers:
  - {name: Ocp-Apim-Subscription-Key, value: '[API-KEY-VALUE]', required: true, note: VS NDC API key}
  - {name: Accept, value: application/xml, required: true}
  - {name: Content-Type, value: application/xml, required: true}
encoding: UTF-8 required on both request and response
transport:
  method: POST
  note: >-
    "We make a POST call to all of our API endpoints" - every NDC message is an HTTP POST with an
    IATA NDC 21.3 XML body. No base URL is published; endpoints are issued with the key.
callback_authentication:
  surface: OrderChangeNotif (airline-to-seller push)
  note: >-
    Registering to receive OrderChangeNotif requires the seller to supply its own endpoint URL, SOAP
    Action and API login credentials (UserID and Password) plus API username/key and IATA number /
    Aggregator ID - so the inbound direction is authenticated by seller-supplied credentials, not by
    a Virgin Atlantic signature header.
  docs: https://ndc.virginatlantic.com/docs/orderchangenotif
  detail: asyncapi/virgin-atlantic-orderchangenotif-webhooks.yml
access_gate:
  self_serve_test_key: true
  production_requirements:
    - Valid IATA accreditation and Virgin Atlantic ticketing authority (Direct Connection), or an
      approved Service Provider Connection
    - RED Tier certification minimum
    - Signed Technical User Agreement (TUA), Data Processing Agreement (DPA) and, for agents, the
      Agency Sales Agreement (ASA)
  docs: https://ndc.virginatlantic.com/help/how-to-access-ndc-apis
not_published:
  - OAuth 2.0 / OpenID Connect (no /.well-known/openid-configuration or oauth-authorization-server
    document exists on any Virgin Atlantic host - see well-known/virgin-atlantic-well-known.yml)
  - Scopes or permission model (no OAuth surface, so scopes/ is intentionally absent)
  - Key rotation policy, key expiry or per-key rate limits
  - Request signing, mTLS or IP allow-listing requirements