Travel Servicing Architecture

The lifecycle does not end when a travel booking is confirmed. Much of the production complexity appears in post-booking servicing: change, cancellation, refund, exchange, ancillary updates and involuntary schedule changes.

Reference architecture

Travel servicing architecture

Mermaid source (.mmd)

Servicing intent

Do not call the provider directly from a UI mutation. Persist an internal intent with booking ID, operation, requested changes, booking version, authorization, quote/rules snapshot, idempotency key and correlation ID.

Capability check

Provider support differs. Maintain explicit capabilities for voluntary/involuntary changes, cancellation, partial cancellation, refund, partial refund, exchange/reissue, ancillaries and passenger/name correction.

Quote before mutation

Change, cancellation and refund should pass through a quote/rules step. Present fare difference, penalty, refundable amount, tax/fee impact and new travel terms before execution.

Separate states

Keep BookingState, PaymentState, Ticket/DocumentState and ServicingAttemptState independent. A booking can be cancelled while the refund remains incomplete.

UNKNOWN servicing

A timeout does not prove that the provider mutation failed. Use UNKNOWN state and reconciliation before retrying.

Concurrent servicing

Prevent parallel mutations against the same booking using booking versions or a servicing lock.

Provider event reconciliation

Async schedule changes, cancellations or ticket updates should be deduplicated, ordered and correlated with local servicing attempts.

Failure modes

Quote/execution drift, successful change with failed payment adjustment, cancellation with incomplete refund, reissue failure, stale booking mutation, duplicate servicing retry and provider-event races.

Observability

Track servicing success, quote-to-execution mismatch, change/cancel latency, UNKNOWN servicing, refund age, reissue failures, reconciliation resolution and manual intervention.

Production checklist

Use capability maps, quote-before-mutate, booking-version guards, operation-scoped idempotency, UNKNOWN state, separate payment/document state, reconciliation, audit trails and manual fallback.