Intui integration

Lakpura is a live supplier and a carrier on intui.travel. Two independent surfaces run between us: Intui calls our API IN endpoints to search, quote and book; and Intui posts order callbacks when a marketplace order is created or changed.

Live status

API IN Healthy Intui → Lakpura

2589calls 24 h

100%success 24 h

8s agolast call

13298calls 7 d

7 msmedian

18 msp95

48 unsigned request(s) rejected with 403 in the last 24 h, excluded from the figures above.

API OUT No calls in 24 h Lakpura → Intui

0calls 24 h

—success 24 h

5d agolast call

1calls 7 d

—median

—p95

API INAPI OUT — calls per hour, last 24 h (peak 223)

By endpoint — last 7 days

Flow	Endpoint	Calls	Success	Median	p95
IN	POST /{id}/search/	13282	100%	7 ms	21 ms
IN	GET /{id}/search/{id}/{price_mark}/	14	50%	35 ms	77 ms
OUT	POST /booking/confirm/	1	100%	467 ms	467 ms
IN	POST /booking/	1	100%	276 ms	276 ms
IN	POST /{id}/search/{id}/	1	100%	29 ms	29 ms

Aggregated from the request/response audit log, over signature-valid calls only — requests rejected at the signature never reach a handler and are counted separately. Volatile path segments are collapsed ({price_mark}, {vehicle_id}); request and response bodies are never published.

Endpoints

API IN — live supplier (Intui → Lakpura)

Base URL, as configured in the Intui fleet portal:

https://api.lakpura.com/intui/

Method	Path	Purpose
POST	/search/	Vehicle search — returns available vehicles and a `price_mark`
GET	/search/{vehicle_id}/{price_mark}/	Locked quote; 404 once the mark expires
POST	/search/{vehicle_id}/	Re-quote a single vehicle; `NO_VEHICLE` if it drops out
POST	/booking/	Create an order — stored, projected to a job, then auto-confirmed
POST	/booking/cancel/	Cancel an order
POST	/booking/update/	Accept changed order details
POST	/booking/confirm/	Inbound confirm acknowledgement

Unknown resources return 404 with {"status":"ERROR","error":"api method is not supported"}.

Order callbacks — carrier (Intui → Lakpura)

Both the new order and order change callback fields take this one URL — the handler branches on the payload's type:

https://api.lakpura.com/intui/callback?token=<shared secret>

API OUT (Lakpura → Intui)

Outbound calls we make against api.intui.travel/apiin/<user_id>/ — order confirm/decline, driver info, driver location, change confirmation, no-show reports, and the vehicle brandlist lookup. These are the OUT rows above.

Authentication

The two surfaces authenticate differently — they are not interchangeable.

Surface	Mechanism
API IN	`PrivateKey` header = `SHA1(full URL + raw body + private key)`. The URL is signed material, so the base URL cannot change without re-pointing it in the fleet portal. `GET /brandlist/` is exempt.
Callbacks	Shared secret as `?token=` or `X-Callback-Token`. Not a signature. In addition the posted body is never trusted — the order is re-fetched from Intui's authenticated API before anything is written.

A bad or missing credential returns 403. Every request and response on both surfaces is written to a mandatory audit log.

Notes

Five strikes. Intui auto-disables “API IN is ON” after 5 consecutive non-responses, so we never return 404 for a path Intui legitimately calls, and an hourly heartbeat probes /search/ and alerts before that threshold is reached.
Legacy bases stay live. app.lakpura.com/api/intui/ and app.lakpura.com/?module=intui-callback continue to work, so the two bases can be re-pointed independently.
Active-active. This hostname is served from Colombo and Washington DC behind a load balancer, so consecutive calls in one flow may be handled by different origins.