Intui integration

Lakpura is a live supplier and a carrier on intui.travel. Two independent surfaces run between us: Intui calls our API IN endpoints to search, quote and book; and Intui posts order callbacks when a marketplace order is created or changed.

Live status

API IN Healthy Intui → Lakpura

49calls 24 h

100%success 24 h

22m agolast call

337calls 7 d

8 msmedian

20 msp95

48 unsigned request(s) rejected with 403 in the last 24 h, excluded from the figures above.

API OUT No calls in 24 h Lakpura → Intui

0calls 24 h

—success 24 h

9d agolast call

0calls 7 d

—median

—p95

API INAPI OUT — calls per hour, last 24 h (peak 3)

By endpoint — last 7 days

Flow	Endpoint	Calls	Success	Median	p95
IN	POST /{id}/search/	336	100%	8 ms	18 ms
IN	POST /booking/cancel/	1	100%	41 ms	41 ms

Aggregated from the request/response audit log, over signature-valid calls only — requests rejected at the signature never reach a handler and are counted separately. Volatile path segments are collapsed ({price_mark}, {vehicle_id}); request and response bodies are never published.

Endpoints

API IN — live supplier (Intui → Lakpura)

Base URL, as configured in the Intui fleet portal:

https://api.lakpura.com/intui/

Method	Path	Purpose
POST	/search/	Vehicle search — returns available vehicles and a `price_mark`
GET	/search/{vehicle_id}/{price_mark}/	Locked quote; 404 once the mark expires
POST	/search/{vehicle_id}/	Re-quote a single vehicle; `NO_VEHICLE` if it drops out
POST	/booking/	Create an order — stored, projected to a job, then auto-confirmed
POST	/booking/cancel/	Cancel an order
POST	/booking/update/	Accept changed order details
POST	/booking/confirm/	Inbound confirm acknowledgement

Unknown resources return 404 with {"status":"ERROR","error":"api method is not supported"}.

Order callbacks — carrier (Intui → Lakpura)

Both the new order and order change callback fields take this one URL — the handler branches on the payload's type:

https://api.lakpura.com/intui/callback?token=<shared secret>

API OUT (Lakpura → Intui)

Outbound calls we make against api.intui.travel/apiin/<user_id>/ — order confirm/decline, driver info, driver location, change confirmation, no-show reports, and the vehicle brandlist lookup. These are the OUT rows above.

Authentication

The two surfaces authenticate differently — they are not interchangeable.

Surface	Mechanism
API IN	`PrivateKey` header = `SHA1(full URL + raw body + private key)`. The URL is signed material, so the base URL cannot change without re-pointing it in the fleet portal. `GET /brandlist/` is exempt.
Callbacks	Shared secret as `?token=` or `X-Callback-Token`. Not a signature. In addition the posted body is never trusted — the order is re-fetched from Intui's authenticated API before anything is written.

A bad or missing credential returns 403. Every request and response on both surfaces is written to a mandatory audit log.

Notes

Five strikes. Intui auto-disables “API IN is ON” after 5 consecutive non-responses, so we never return 404 for a path Intui legitimately calls, and an hourly heartbeat probes /search/ and alerts before that threshold is reached.
Legacy bases stay live. app.lakpura.com/api/intui/ and app.lakpura.com/?module=intui-callback continue to work, so the two bases can be re-pointed independently.
Active-active. This hostname is served from Colombo and Washington DC behind a load balancer, so consecutive calls in one flow may be handled by different origins.