# Managing travel bookings using ICCP Virtual Cards source: https://developer.mastercard.com/iccp/documentation/03_use-cases/manage-travel-booking/index.md > ICCP API enables corporates to generate virtual cards for travel-related bookings. It supports secure, single-use payments tied to specific transactions, such as hotel or airline bookings, with strict controls to prevent misuse. ## Scenario {#scenario} An Online Travel Agency (OTA), TravelEase, allows customers to book hotels and flights worldwide through its platform. TravelEase collects payment from the customer upfront and then pays the hotel or airline supplier. ## System and User Roles {#system-and-user-roles} | User | Roles | |-----------------------------|-------------------------------------------------------------------------------------| | OTA/Integrator (TravelEase) | Facilitates customer bookings and initiates virtual card generation. | | Travel Website (GoFlyNow) | Facilitates customer flight bookings using the tech platform from OTA. | | Supplier (British Airways) | Receives payment through the virtual card. | | ICCP System | Facilitates virtual card issuance, control enforcement, and reporting through APIs. | ### Process {#process} 1. A traveler books a round-trip flight from New York (JFK) to London (LHR) on GoFlyNow and pays $1,200 using their credit card. 2. Instead of using a corporate credit card or bank transfer, GoFlyNow generates a single-use virtual card for $1,200, restricted for airline ticket purchases only. 3. The virtual card is linked to this specific booking and has a validity window of 24 hours to prevent misuse. 4. The airline (for example, British Airways) charges the virtual card for the exact ticket amount. 5. The ticket is confirmed, and the booking reference is shared with GoFlyNow. ## APIs Involved {#apis-involved} | API | Function | |----------------------------------------------|-------------------------------------------------------------------------------| | `Submit Purchase Request API` | Used to generate virtual cards for specific travel bookings. | | `GET Purchase Request API` | Used to retrieve details of an existing virtual card for validation or audit. | | `GET Suppliers API` | Used to retrieve supplier profiles (such as hotel chains, airlines). | | `GET Purchase Templates API` | Used to retrieve available purchase templates for travel transactions. | | `GET Purchase Template Details API` | Used to fetch configuration details of a selected purchase template. | | **Reporting APIs** (SOAP) | | | `getPurchaseRequestDetail` | Tracks PR metadata and status | | `GetVCNAuthsReport`, `GetVCNClearingsReport` | Details transaction-level data for reconciliation. | | **Event Notification APIs** (REST) | | | `POST /subscriptions` | Registers for event types. | | `GET /notifications` | Retrieves near real-time transaction and card status events. | ## Pre-requisites {#pre-requisites} | Item | Description | |-----------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Real Card Registration | Register a valid real card within the ICCP UI. Typically done by the issuer. | | Purchase Template Setup | Configure by providing the controls and CDF values. This can be enabled either by the issuer or the corporate. | | Auto-Approve Purchase Group Setup | Configure an auto-approve purchase group by linking eligible real cards and purchase templates. This can be enabled either by the issuer or the corporate. | | Supplier Setup | Vendor profiles must be correctly configured by the issuer or corporate. | | Multi-Use Card Requirement | Virtual cards used for recurring payments must not be single use. This allows the card to support multiple transactions over its validity period. Ensure that the **Single-use Virtual Card Numbers (VCN) only** setting is set as **Off** under Company Settings. | ## Standard Controls {#standard-controls} | Control Name | Purpose | Sample Parameters | |------------------|-------------------------------------------------------------------|---------------------------------------------------------------------| | Validity Control | Restricts the card's active duration to prevent misuse. | `validFrom`: "2025-10-01T08:00:00" `validTo`: "2025-10-02T08:00:00" | | Velocity Control | Ensures the card is used only once or within a defined frequency. | `maxTrans`: "1" | ## Optional Controls {#optional-controls} | Control Name | Purpose | Sample Parameters | |----------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------| | Geography Control | Restricts card usage to specific regions or countries. | `allowedCountries`: \["GB", "US"\] | | Transaction Limit Control | Caps the maximum spend per transaction. | `transactionLimit`: "1200" | | Merchant ID Control | Restricts usage to a specific supplier or merchant. | `merchantId`: "BRITISH_AIRWAYS_001" | | MCC Control | Restricts transactions to specific Merchant Category Codes (MCCs) associated with allowed purchase types. | `mccList`: \["4816", "5734"\] | | Currency Control (Currency Type) | Defines the currency used for authorization checks - Merchant Currency or Billing Currency. Enables restriction to specific transaction currency. | `currencyCode`: "USD" `currencyType`: "MERCHANT_CURRENCY" | ## Reconciliation Options {#reconciliation-options} To ensure accurate tracking and validation of payments made through the virtual cards, corporates can leverage ICCP's reporting and notification APIs for reconciliation: ### Purchase Request Detail {#purchase-request-detail} Use the `getPurchaseRequestDetail` API to retrieve information about a purchase requests, including metadata, such as card number, supplier, amount, and status. This API will also provide the available number of transactions, balance, and limits on the virtual card. ### Authorization and Clearing Reports {#authorization-and-clearing-reports} ICCP provides detailed reports on transaction-level data, including timestamps, merchant information, and the results of control validations. These reports (`GetVCNAuthsReport`, `GetVCNClearingsReport`) are used to reconcile virtual card transactions against invoices and vendor billing cycles. ### Exception and Control Failure Reporting {#exception-and-control-failure-reporting} ICCP's Authorization and Clearing Reports include fields such as `InControlResponse` that indicate when a transaction has breached a configured control (such as velocity, validity, merchant restrictions). These control failure indicators help quickly identify and address anomalies. The `GetVCNClearingExceptionReport` API further highlights cases where clearing amounts exceed cumulative limits. Reports must be requested; they are not automatically sent. Alternatively, commercial event notifications can push relevant events as they happen. ### Event Notification APIs {#event-notification-apis} Near real-time notifications are available for transaction events, card status changes, and control triggers, enabling automated reconciliation workflows by subscribing to relevant event types. ## Process Flow {#process-flow} Diagram manage-travel-book ### Workflow {#workflow} #### 1. Booking Initiation {#1-booking-initiation} * Customer books travel on the **TravelEase** platform. * **GoFlyNow** collects payment and initiates virtual card creation through `Submit Purchase Request` API. #### 2. Card Configuration {#2-card-configuration} * GoFlyNow uses `GET Suppliers` API to retrieve supplier profile. * Uses `GET Purchase Templates` API and `GET Purchase Template Details` API to select and configure the appropriate template. * Applies mandatory and optional controls to the virtual card. #### 3. Card Issuance {#3-card-issuance} * ICCP issues a single-use virtual card tied to the booking. * Validity is restricted to 24 hours and the merchant is locked to the airline. #### 4. Payment Execution {#4-payment-execution} * Supplier British Airways charges the virtual card. * Booking is confirmed and reference is shared with GoFlyNow. #### 5. Reconciliation {#5-reconciliation} * Pull Purchase Request Report to confirm PR metadata. * Pull a Transaction Report to validate actual spending. * Review the `InControlResponse` field in the Authorization and Clearing Reports (`GetVCNAuthsReport`, `GetVCNClearingsReport`) to identify any control violations, such as validity, geography, or merchant restrictions. * Subscribe to `Event Notification` API for near real-time updates. ## Integration notes and API usage guidance {#integration-notes-and-api-usage-guidance} ### Card Generation {#card-generation} * Use the Submit Purchase Request API to create virtual cards for travel bookings. * Ensure the card is configured as single use with strict validity and merchant controls. ### Template and Supplier Setup {#template-and-supplier-setup} * Use `GET Suppliers API` to retrieve supplier profiles. * Use `GET Purchase Templates API` and `GET Purchase Template Details API` to select and configure the appropriate purchase template. ### Event Notifications {#event-notifications} Subscribe to the `Event Notification API` to receive near real-time updates on card status changes, including control breaches and spend alerts. ### Control Management: {#control-management} ICCP APIs allow configuration of controls during card creation to ensure secure and compliant travel payments.