PNR Status API: Check a Flight PNR in Code (2026)

You searched for a PNR status API, so you probably want one thing: type in a booking code, get back "confirmed" or "cancelled." It sounds like it should exist. Everyone has a PNR, and every airline has a "check PNR" page.

The honest answer is more interesting. There is no single API that checks any PNR. There are several APIs that can read a booking, but each one only reads bookings made through its own system, and only for the party that made them. This guide explains why, shows what each option looks like, and tells you which one fits your project.

What a PNR is, in plain words#

When you book a flight, the reservation system creates a file for your trip. That file is the passenger name record. It holds who is travelling, the flights, contact details and what happened to the booking. The system also gives the file a short code so staff and customers can find it quickly.

The code is called many things: PNR, record locator, booking reference, confirmation number. Here is what we can say about it, from Wikipedia's record locator article and the Duffel documentation:

• It is usually 6 alphanumeric characters. Some systems use 7 or 8.
• Characters that are easy to mix up, such as 1, I, L, 0 and O, are often left out. Examples from Wikipedia: RMT33W, KZVGX5.
• Each reservation system makes its own codes. A code is unique inside one system at one time, and can be reused after the old record is purged.
• Everyone on the same booking shares the same code.

Two details matter for developers. First, one trip can have several PNRs. A travel agent booking creates a record in the agency's system and separate ones in each airline's system. Duffel's order object reflects this: it has a booking_reference for the main airline reference and booking_references listing every carrier's PNR on the order. Second, the code on your confirmation email may not be the one a particular system can find, because the airline code and the agency code can differ.

PNR status vs flight status#

People mix these up, and it changes which API you need.

A booking can show "confirmed" while its flight is delayed two hours. If your real goal is "tell my users their flight is late," skip PNRs completely. We list flight data options in our flight booking API comparison and the wider best travel APIs guide.

Why one API cannot check every PNR#

Three reasons, all structural:

1. Codes are local. A code only means something inside the system that issued it. There is no global directory of PNRs.
2. Access is tied to who booked. Virgin Atlantic's NDC documentation says the order retrieve service is limited to the seller that created the order. Travelport's docs describe retrieving a reservation with a locator your own booking returned. Sabre's retrieve call needs your agency credentials.
3. Privacy. A PNR record holds names, contact details and itinerary. In the EU, Directive 2016/681 treats this data as sensitive enough to regulate how airlines pass it to authorities. Open public lookup would be a privacy problem.

So the question to ask is not "which API checks any PNR?" but "which system holds my bookings?"

The options, compared#

We read the official documentation for each of these in October 2026. We did not run live calls against Sabre, Travelport or Amadeus because they need approved partner credentials.

Reading the table: if you are a small team, Duffel is the realistic way to both create and retrieve bookings. The big GDS options (Sabre, Travelport, Amadeus) are agency-level products. For a fuller comparison of what each can book, read our flight booking API guide.

How to retrieve a booking: Duffel example#

Duffel's documentation says you retrieve an order with one GET request. The reply holds the airline reference under booking_reference. Example value in their docs: RZPNX8.

curl --compressed "https://api.duffel.com/air/orders/ord_00009hthhsUZ8W4LxQgkjo" \
  -H "Accept: application/json" \
  -H "Duffel-Version: v2" \
  -H "Authorization: Bearer $DUFFEL_ACCESS_TOKEN"

The reply is wrapped in a top-level data key. Fields worth reading:

{
  "data": {
    "id": "ord_00009hthhsUZ8W4LxQgkjo",
    "booking_reference": "RZPNX8",
    "booking_references": [],
    "payment_status": {},
    "cancelled_at": null,
    "live_mode": false
  }
}

We have not run this against a live Duffel account. The path, headers and field names come from Duffel's order documentation, and the JSON above is trimmed to the fields we want to show. Test with a sandbox token first, and note the live_mode flag tells you whether the order is a test one.

The lesson: you store the order ID when you create the booking, and use it later. If a customer only gives you a PNR, you need your own database to map it to the order.

How to retrieve a booking: Travelport example#

Travelport's Reservation Retrieve guide shows the locator going straight into the URL path. The example from their guide:

https://api.pp.travelport.com/11/air/book/reservation/reservations/{LocatorCode}?detailViewInd=true

Replace {LocatorCode} with the locator returned when you committed the booking. The guide says detailViewInd=true adds extra detail such as accounting and history remarks. The response includes the offer, travellers, forms of payment and, for ticketed itineraries, payment and ticket numbers. Group bookings are not supported.

One useful detail from the same guide: ticketless carriers (it names F9, NK and SY) return a single ticket number for all travellers, and only after the airline responds, which can take several hours. So "no ticket number yet" is not always an error. We did not call this endpoint, because it needs Travelport credentials.

Sabre and the older GDS style#

Sabre's Retrieve Itinerary (GetReservationRQ) documentation says the PNR locator is the search key, and the request type matters:

• Trip for read-only access.
• Stateful when you want to change the booking afterwards.
• Only one locator per request. Several in one request will not process correctly.

Sabre also warns that versions up to 1.14.0 will be decommissioned, so check its retirement schedule before you build on an old version. A REST Get Booking API exists too; Sabre documents the booking ID as the PNR locator or NDC order ID depending on content. We could not open that reference page, so check the exact path on the Sabre developer site.

Is it safe to expose PNR lookup in your app?#

If you build a "check my booking" page, think about abuse. In December 2016, researchers at SR Labs, speaking at the Chaos Communication Congress, said the big GDS platforms (Amadeus, Sabre and Travelport) lacked a proper first authentication factor. With just a booking code and a last name, they said an attacker could view bookings, steal miles and cancel flights. They also pointed out that the restricted character set made guessing easier, and that booking codes sit on bag tags and boarding passes.

We did not verify what each vendor has fixed since 2016, but the practical lessons still hold for your own page:

• Never accept a PNR alone. Ask for the PNR plus the last name, and rate-limit attempts.
• Do not return the full record. Show the status and flight, not passport or contact data.
• Log failed lookups. The researchers said the systems had no logging for abuse. Add yours.
• Tell users not to post boarding passes online.

For general design rules on rate limits and error shapes, see our guide on API design principles.

What about Indian Railways PNR status?#

If you came here for trains: the railway PNR is a 10-digit number from the Indian Railways reservation system. The common explanation from ixigo is that the first digit points to the zone where the journey starts, the next two digits identify the reservation centre, and the rest are random. Another page we found maps the first digit differently, so treat the digit meanings as unconfirmed.

On the developer side, we found no official public railway PNR API. What exists are third-party services and community packages, for example an npm package called railway-api that wraps a service requiring its own key, and a Python tool that reads data from ConfirmTKT. One older developer page describes a PNR service as suspended. Since these are unofficial, read the terms and verify against IRCTC before you rely on them.

Which one should you choose?#

• "I want to show my customers their booking status." Store the order ID when you book, and call that system's retrieve endpoint. On a small team, use Duffel.
• "I run a travel agency on Sabre or Travelport." Use the retrieve API your contract already includes, with the locator your booking returned.
• "I just want to know if a flight is late." Use a flight status API with flight number and date. Do not use a PNR API.
• "I want to look up random strangers' PNRs." You cannot, and you should not try.
• "I want to build a generic PNR checker website." Redirect users to the airline's own manage-booking page. That is also what the consumer guides we read recommend.

Booking and flight data usually refer to airlines and airports by IATA codes. To turn a code into a name for your screens, you can get an airline by IATA code or get an airport by IATA code with our Airport and Airline Lookup API. It does not look up PNRs.

A checklist before you build#

• Do I know which system created the booking?
• Am I storing the order ID or locator at booking time?
• Do I need booking status, flight status, or both?
• Does my lookup need a last name as well as the code?
• Have I rate-limited and logged lookups?
• Have I tested in a sandbox before using live credentials?

If you are unsure what an API is or how a GET request works, start with what is a REST API.

Frequently asked questions#

What is a PNR?#

PNR stands for Passenger Name Record. It is the record a booking system keeps for one booking, and also the short code, usually 6 letters and digits, that finds the record. It is also called a record locator, booking reference or confirmation number.

Is there a PNR status API that works for any airline?#

Not that we could find. Each reservation system issues its own codes, and retrieve APIs are built for bookings made through your own account or agency.

What is the difference between PNR status and flight status?#

PNR status describes the booking, such as confirmed or cancelled. Flight status describes the aircraft's journey, such as on time or delayed. They use different lookups and different systems.

How do I check a flight PNR status as a traveller?#

Use the airline's website or app, open Manage Booking, and enter the PNR with your last name. If you booked through a travel site, check there first.

Can I look up a PNR with an API if I did not make the booking?#

Generally no. Virgin Atlantic's NDC documentation says only the seller that created the order can retrieve it, and GDS access needs agency credentials.

Is a PNR safe to share?#

Be careful. Researchers showed in 2016 that a PNR plus last name was enough to access some bookings. Keep boarding passes and bag tags private.

Is an Indian Railways PNR the same thing?#

No, it is a separate 10-digit number from the railway reservation system. We found no official public API for it.

Sources and what we did not test#

We read the following in October 2026: the Wikipedia article on record locators, Duffel's order documentation, Travelport's Reservation Retrieve guide and Universal Record pages, Sabre's Retrieve Itinerary and GetReservation pages, ATPCO and Virgin Atlantic NDC OrderRetrieve documentation, press coverage of Amadeus closing its Self-Service portal (PhocusWire and others), the EU PNR Directive text on legislation.gov.uk, SR Labs research as reported by TechSpot and Travel Weekly, and consumer guides from ixigo, Skyscanner and others for the traveller steps and the railway PNR format.

Not tested: none of the code above was run against a live account. Several vendor details come from vendor pages, and we say so where it matters. Prices, access rules and deprecation dates change often, so confirm on the vendor's site before you build.