Publish APIs
Publishing puts your API in front of consumers — internal teams, travel partners, and third-party developers. This guide covers what has to be true before you publish, and what changes the moment you do.
Before you publish
Confirm three things. The OpenAPI specification validates cleanly and matches what the service actually returns. An authentication strategy is attached, so the API is never reachable without a credential. And a rate limit is configured that reflects real capacity rather than an optimistic guess — the gateway enforces it, so it protects the upstream service whether or not the caller behaves.
Choose your audience
Decide who should see the API before you publish it, not after. Internal-only APIs stay restricted to authenticated Turkish Airlines teams. Partner APIs are scoped to approved applications belonging to named organizations. Public APIs are visible to anyone with a portal account. Audience is enforced by the gateway at request time, not by obscurity of the URL.
Code sample
bash
# Request a token, then call a published API
TOKEN=$(curl -s -X POST \
https://sso.apim.turkishairlines.com/realms/tk/protocol/openid-connect/token \
-d grant_type=client_credentials \
-d client_id="$TK_CLIENT_ID" \
-d client_secret="$TK_CLIENT_SECRET" | jq -r .access_token)
curl -s https://api.turkishairlines.com/v1/timetable \
-H "Authorization: Bearer $TOKEN" \
-G --data-urlencode "origin=IST" \
--data-urlencode "destination=LHR"
Plan for change
A published API has consumers, and consumers constrain what you can change. Read how Turkish Airlines versions APIs without breaking existing integrations.