Travel Health API

Overview

The Travel Health API returns travel health reference information for a destination: vaccine requirements and recommendations, malaria prevention and CDC travel notices. Responses are in English or Arabic. During the pilot, access is by API key on request.

Authentication

Send your API key in the X-API-Key header on every request. Keys are issued to your organization. Keep them on your server, never in browser or mobile app code.

X-API-Key: <your-api-key>

The request

Choose the destination with the country parameter (ISO alpha-2 such as KE, alpha-3 such as KEN, or a slug such as kenya) and the language with lang (en or ar; without it, Accept-Language, then English). If you send a travel date, send it only in the X-Travel-Date header (YYYY-MM-DD), never in the URL. Send If-None-Match with a previous ETag to get 304 when nothing changed.

countrylangX-Travel-Date

Languages and Arabic fallback

Ask for Arabic with lang=ar. Where reviewed Arabic isn't available yet, that content is served in English instead. The response says what you received: meta.lang_served is the language served and meta.lang_fallback shows whether English was used in place of the requested language; each entry carries its own lang_served and lang_fallback. meta.coverage gives fields_total, fields_in_requested_lang and percent.

lang_servedlang_fallbackcoverage

Errors

Errors are returned as application/problem+json with a code:

400

date-in-query: the travel date was sent in the URL. Send it in the X-Travel-Date header.

401

missing-key, invalid-key or revoked-key: check the X-API-Key header.

404

unknown-country or destination-not-available.

409

ambiguous-country: the code matches more than one destination; the response lists the candidates.

422

invalid-country-format, invalid-date or past-date.

429

rate-limited (wait for the Retry-After header) or quota-exceeded.

Rate limits

Requests are limited by rate and by quota. Over the rate limit you receive 429 rate-limited with a Retry-After header: wait that long before retrying. When the quota is used up you receive 429 quota-exceeded.

Privacy

The API accepts no patient data: don't send names, identifiers or health information. The travel date is used only to answer the request; it isn't logged or stored.

Versioning

The major version is part of the path (/api/ext/v1). Every response states its contract version in meta.contract_version.