# Spirit Airlines Mobile API

Extracted from `com.spirit.customerapp` v4.7.0 (build 1340)

## Base URL

| Environment | URL |
|-------------|-----|
| **Production** | `https://api.spirit.com/customermobileprod/2.8.0/` |
| QA1 | `https://apiqa.spirit.com/qa01-customermobileapi/` |
| QA2 | `https://apiqa.spirit.com/qa02-customermobileapi/` |
| Dev1 | `https://apiqa.spirit.com/dev01-customermobileapi/` |
| Dev2 | `https://apiqa.spirit.com/dev02-customermobileapi/` |
| Stage | `https://api.spirit.com/stage-customermobileapi/` |
| CMS | `https://content.spirit.com/api/content/` |

## Standby / Board of Availability (BOA)

Spirit uses "BOA" (Board of Availability) as their standby system:

```
GET  https://api.spirit.com/customermobileprod/2.8.0/v1/getboaparameters
POST https://api.spirit.com/customermobileprod/2.8.0/v1/getboastatus
```

### BOA Status Request
- **Method:** POST
- **Body:** `BoaStatusRequestDto` (JSON)
- **Response:** `BoaStatusResponseDto` containing `BoaStatus` objects

### BOA Data Model
- `BoaStatusInfo` — status of standby position
- `boaStatusChecker` — polls for status updates using a `boaUniqueSessionToken`
- `isStandby` — boolean flag on trip/flight objects
- `standby` — standby details on trip segments

### BOA Flow
1. Call `v1/getboaparameters` to get BOA config
2. Call `v1/getboastatus` with flight/booking details
3. Poll using `boaStatusChecker` with session token for updates

## All API Endpoints

### Authentication
| Method | Path | Description |
|--------|------|-------------|
| POST | `v2/Token` | Fetch auth token |
| POST | `v3/Token` | Fetch v3 auth token |
| PUT | `v3/Token` | Refresh v3 token |

### Init & Config
| Method | Path | Description |
|--------|------|-------------|
| GET | `v1/init` | App initialization |
| GET | `v1/stations` | Airport station list |
| GET | `v1/OnD/Countries` | Country reference data |

### Flight Search & Status
| Method | Path | Description |
|--------|------|-------------|
| POST | `v5/Flight/Search` | Search flights |
| POST | `v3/GetFlightInfoBI` | Flight info |
| POST | `v1/booking/flightdetails` | Flight details |
| POST | `v1/calendar/availabledates` | Available dates calendar |

### Booking
| Method | Path | Description |
|--------|------|-------------|
| GET | `v1/booking/retrieve` | Retrieve booking (params: RecordLocator, LastName) |
| GET | `v1/booking` | Get booking state |
| GET | `v1/booking?screenType=ReviewTempStay` | Booking review |
| PUT | `v2/booking` | Update booking |
| POST | `v1/booking/book` | Confirm booking |
| POST | `v1/trip/sell` | Sell trip |
| POST | `v2/ValidateBookingRequest` | Validate booking |

### Standby / BOA
| Method | Path | Description |
|--------|------|-------------|
| **GET** | **`v1/getboaparameters`** | **Get BOA (standby) parameters** |
| **POST** | **`v1/getboastatus`** | **Get standby status** |

### Check-in & Boarding
| Method | Path | Description |
|--------|------|-------------|
| POST | `v1/booking/checkin/journey` | Check in for journey |
| POST | `v2/booking/boardingpasses/journey` | Get boarding passes |

### Trip Management
| Method | Path | Description |
|--------|------|-------------|
| POST | `v1/managetrip` | Manage trip |
| POST | `v2/tripdetails` | Get trip details |
| POST | `v3/mytrips` | Get my trips |
| POST | `v1/booking/passengers/passengerreturndates` | Passenger return dates |

### Seats
| Method | Path | Description |
|--------|------|-------------|
| GET | `v1/booking/seatmap` | Get seat map |
| GET | `v4/booking/seatmaps/` | Get seat maps v4 |
| POST | `v4/booking/passengers/{passengerKey}/seats/{unitKey}` | Assign seat |

### Bags
| Method | Path | Description |
|--------|------|-------------|
| POST | `v1/bags` | Get bags |
| PUT | `v1/bags/update` | Update bags |

### Bundles & Upsell
| Method | Path | Description |
|--------|------|-------------|
| GET | `v3/options` | Get options |
| PUT | `v1/options/update` | Update options |
| POST | `v1/bundle/UpsellAvailability` | Upsell availability |
| POST | `v3/bundle/ssrs` | Bundle SSRs |
| POST | `v4/bundle/ssrs` | Bundle SSRs v4 |
| POST | `v2/cart` | Manage cart |

### Payments
| Method | Path | Description |
|--------|------|-------------|
| POST | `v1/booking/payments/fetchredemptiondetail` | Fetch redemption |
| POST | `v1/booking/payments/redeem` | Redeem points |
| DELETE | `V3/User/Person/StoredPayments/{key}` | Delete stored payment |

### Account
| Method | Path | Description |
|--------|------|-------------|
| POST | `v1/FreeSpirit/CreateAccount` | Create Free Spirit account |
| POST | `v1/FreeSpirit/Booking/CreateAccount` | Create account during booking |
| GET | `v1/User/Person` | Get user profile |
| POST | `v1/account/password/reset` | Reset password |
| POST | `v1/account/updateexpiredpassword` | Update expired password |
| POST | `v1/account/points` | Account points |
| POST | `v1/points` | Points |
| POST | `v1/MemberInfo/ValidateFSNumber` | Validate Free Spirit number |
| POST | `v1/registerForPromotion` | Register for promotion |

### Documents & SSR
| Method | Path | Description |
|--------|------|-------------|
| POST | `v1/booking/passengers/{key}/documents` | Add travel doc |
| PUT | `v1/booking/passengers/{key}/documents/{docKey}` | Update travel doc |
| POST | `v1/booking/passengers/{key}/infant/documents` | Add infant doc |
| POST | `v1/document/validate` | Validate document |
| POST | `v1/booking/ssrs/add/acia` | Add SSR |
| POST | `v2/trip/specialassistance` | Special assistance |
| POST | `v3/ssrs/health-ack/accept` | Accept health acknowledgment |
| POST | `v3/ssrs/health-ack/decline` | Decline health acknowledgment |

### Other
| Method | Path | Description |
|--------|------|-------------|
| GET | `v1/GetContent/help` | Help content |
| POST | `v1/getdynamiccontent` | Dynamic content |
| POST | `v1/booking/touristtax` | Tourist tax |
| POST | `v1/booking/passengers/temporarystay/address` | Temp stay address |
| POST | `v1/travelguard/getquote` | Travel insurance quote |

## Security Notes

- **No SSL pinning** in network_security_config.xml
- **No PairIP or anti-tamper** protection
- Uses Retrofit2 for HTTP
- Auth via token-based system (`v2/Token`, `v3/Token`)
- `libakamaibmp.so` present — Akamai Bot Manager for bot detection
- App runs fine on emulators

## CMS Endpoints

| Path | Description |
|------|-------------|
| `en-US?path=mobile/book/paxtravelingui` | Passenger traveling UI content |
| `en-US?path=mobile/localnotification` | Local notification content |
| `en-US?path=mobile/mytripui` | My trips UI content |