---
title: "Hackathon API"
description: "One hosted API giving you holiday search, TripAdvisor content, and anonymised booking and satisfaction data."
---

> Documentation Index
> Fetch the complete documentation index at: https://docs.easyjet-hackathon.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Hackathon API

The Hackathon API is hosted — there is nothing to install and no database to copy.
It gives you two things:

- **A REST proxy** to the easyJet holidays metasearch API and TripAdvisor. The
  upstream keys live on the server, so you never handle them.
- **A GraphQL API** over anonymised booking, customer satisfaction and member
  data, held in Cloudflare D1.

## Set up your shell

Every example in these docs uses two variables. Set them once and the rest is
copy-paste. Ask the organiser for both.

```sh
export API=https://api.easyjet-hackathon.uk
export KEY=the-key-everyone-shares
```

On Windows PowerShell:

```powershell
$env:API = "https://api.easyjet-hackathon.uk"
$env:KEY = "the-key-everyone-shares"
```

> **Running it on your own machine instead**
>
> You do not have to, but the whole thing runs locally with `cd api && npm run dev`,
> which serves it on `http://localhost:3000` — point `API` there and every example
> below still works. That needs the upstream keys in `api/.env` and a local copy of
> the data, so it is really for whoever maintains the API rather than for teams —
> see `api/README.md` in the repo.

## Authenticate

Every request needs the shared key in an `x-api-key` header.

```sh
curl -H "x-api-key: $KEY" $API/api/geography
```

Without it you get a 401 that tells you which header is missing. Two things are
exempt, because neither can send a header:

- **`/health`**, so you can check the server is up.
- **The GraphiQL page itself**, since a browser cannot attach a custom header when
  you navigate to a URL. The page loads with the key pre-filled, so the queries it
  sends do carry it. Requests for *data* on that same path are not exempt.

> **The key is not a secret from your users**
>
> If you put the key in browser JavaScript, anyone using your app can read it.
> That is fine for a hackathon — just don't build anything on the assumption that
> the key is private.

## Check it works

`/health` needs no key and reports what the server loaded:

```sh
curl $API/health
```

```json
{
  "ok": true,
  "tables": {
"bookings": 100, "csat": 100, "members": 84,
"destinations": 189, "destination_airports": 170,
"hotels": 93, "hotel_images": 2685, "hotel_facility_items": 2013
  }
}
```

Those counts come from the database itself, so a missing or empty table shows up
here before it confuses you in a query.

## What is where

| Path | What |
|---|---|
| `/` | What this is, where the docs are, and the routes below. No key needed. |
| `/health` | Status and row counts. No key needed. |
| `/api/search/*` | Package search — see [REST proxy](/rest-api) |
| `/api/hotel/<code>` | Hotel content |
| `/api/tripadvisor/*` | TripAdvisor Partner API 2.0 |
| `/api/geography` | Destination codes, served from disk |
| `/graphql` | Bookings, satisfaction and members — see [GraphQL API](/graphql-api) |

Open `$API/graphql` in a browser for GraphiQL, where you can
explore the whole data schema and run queries without writing any code.

Source: https://docs.easyjet-hackathon.uk/hackathon-api/index.mdx