ihg.com

Files (2)

• SKILL.md
• login.tcl

SKILL.md (first lines)

# IHG Hotel Search

The anonymous capabilities below need no login (pure curl against the public
availability API). For the member's own account (stays, bookings, points), see
[Member account (logged in)](#member-account-logged-in).

## Capabilities

1. **Hotel discovery by destination** — given a place name, finds all nearby IHG hotels with distance. Pure curl, no browser. Tested and working.
2. **Hotel availability with pricing** — given hotel mnemonic codes, dates, and guest count, returns rate plans with prices. Pure curl. Tested and working.
3. **Price calendar** — given a hotel mnemonic and a date range, returns the lowest nightly rate for each night. Tested and working.
4. **Destination resolution** — resolves a place name to coordinates. May return 403 on some IPs. Tested, works on some machines.
5. **Hotel details (names, addresses, brand info)** — given one or more hotel mnemonics, returns hotel name, full GDS name, brand, address, and more. Pure curl. The `profiles/details` host (`apis.ihg.com/hotels/v1/...`) is Akamai-WAF'd and returns `Access Denied` from some IPs for every method and fieldset (observed blocked 2026-06 while the availability host kept working). When blocked, fall back to `browser-serialiser --dump` on the public `ihg.com/.../<mnemonic>/hoteldetail` page for the name/area.
6. **Room-type / suite availability and refundable-rate check** — given one mnemonic and a date, lists each room type with its live availability tonight and flags which rate plans are refundable. Single property only. Pure curl. Tested and working.

## Member account (logged in)

`login.tcl` signs in to IHG One Rewards and reads the member's own data, driven through `browser-serialiser` (the serialised-browsing skill). IHG ends the session when the browser closes, so each run logs in fresh; there is no token to cache, and crude (pure-Python login) is not viable here.

Credentials live in `~/.config/magazines/config.ini` under `[ihg.com]` (`username`, `password`; the username may be a member number, an email, or a username). The safe interpreter cannot read that file, so the credentials arrive as arguments. Substitute them in the shell with the reader from [`COMMAND-SURFACE.md`](../../COMMAND-SURFACE.md), which moves the password from the file to the argument list without it passing through the conversation:

```bash
ini() { python3 -c 'import configparser,os,pathlib,sys;p=pathlib.Path(os.environ.get("XDG_CONFIG_HOME") or pathlib.Path.home()/".config")/"magazines/config.ini";c=configparser.ConfigParser(interpolation=None);c.read(p);print(c.get(sys.argv[1],sys.argv[2],fallback=""))' "$1" "$2"; }
CRED=("$(ini ihg.com username)" "$(ini ihg.com password)")

browser-serialiser ihg.com/login "${CRED[@]}"            # account summary (name, tier, member #, points)
browser-serialiser ihg.com/login "${CRED[@]}" --stays    # + stays and points-activity JSON
browser-serialiser ihg.com/login --check                 # probe the sign-in form, do not submit
```

The reader disables ConfigParser interpolation, without which a literal `%` in the password raises `InterpolationSyntaxError` and silently yields an empty one. A key `ini` finds unset arrives as an empty argument, and the skill then stops before opening the site and names the `[ihg.com]` key it lacks; pass that to the user as the missing prerequisite.

The account summary emits the IHG One Rewards member number on its own `Member #:` line (parsed from the account-mgmt home page's "Member #" label), then the raw page-text dump that carries name, tier and points balance.

`--stays` returns two raw JSON blocks: `members/v2/profiles/me/stays` (every booking, ordered oldest-first: `confirmationNumber`, check-in/out dates, `hotelMnemonic`, `roomTypeCode`, `rateCode`, `stayId`) and `members/v1/profiles/me/activities` (the points ledger).

### How it works, and what it cannot get

- Sign-in is a SAP CDC (Gigya) widget inside an Angular app. Fill the *visible* widget inputs through the React native-value setter (CDP `Input.insertText` doubles the value in Gigya's password field, which fails login); submit with the policed `click` verb (a trusted CDP mouse click — a synthetic in-page `click()` does not fire Gigya's login). Click the Gigya form's own `input.gigya-input-submit`, not the header "Sign in" link (an `<a>` earlier in the DOM that only toggles a panel).
- The member APIs on `apis.ihg.com` require a bearer (`x-ihg-sso-token`) the app holds in memory plus its `x-cdc-api-key`; neither is reconstructable from storage. The skill captures them from the app's own first authenticated XHR, triggered by clicking a past stay's "View Hotel Bill", then replays the member endpoints with those headers.
- **Points & Cash vs points-only**: the activities ledger distinguishes them. A Points & Cash reward shows a `displayCategory: "Points and Cash Activity"` entry ("Points and Cash Points Purchased – N Night(s)", the points bought with the cash) alongside the `REWARD_NIGHTS_REDEMPTION` points redemption; a points-only reward shows only the redemption.
- **The cash amount is not in any member API.** The stays, folio and reservation endpoints return points and metadata only (folio comes back empty; reservation-detail paths 404). The cash figure lives solely in the booking-confirmation email (from `tx.ihg.com`), charged in USD — fields "Nightly cash amount" / "Total credit card charge". Use the courier skill for that.
- Pace logins. After several rapid sign-ins, Gigya begins returning a transient "We're sorry, something went wrong. Please contact Customer Care" (distinct from the credential-mismatch message); it clears after a few minutes.

## Brand codes

| Code | Brand |
|---|---|
| HICP | Crowne Plaza |
| HIEX | Holiday Inn Express |
| HOLI | Holiday Inn |
| HIRT | Holiday Inn Resort |
| ICON | InterContinental |
| INDG | Hotel Indigo |
| VXVX | voco |
| KIMN | Kimpton |
| RGNT | Regent |
| SIXS | Six Senses |
| EVEN | EVEN Hotels |
| STBR | Staybridge Suites |
| CNDW | Candlewood Suites |

## API details

All endpoints use these headers:
- `x-ihg-api-key: se9ym5iAzaW8pxfBjkmgbuGjJcr3Pj6Y` (static client-side key from IHG's JS bundle)
- `ihg-language: en-GB`
- `ihg-sessionid:` (any UUID)
- `ihg-transactionid:` (any UUID)
- `Origin: https://www.ihg.com`
- `Referer: https://www.ihg.com/`
- `Sec-Fetch-Mode: cors`
- `Sec-Fetch-Site: same-site`
- `User-Agent: $UA`, sent as `-A "$UA"`:

```bash
UA='Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36'  # tested against apis.ihg.com on 2026-10-04
```

The Akamai edge denies a Chrome version that is too old (137 was refused and 139 accepted on that date) and any `HeadlessChrome` UA, with an `Access Denied` page in place of JSON.

The hotel details endpoints require `Sec-Fetch-Mode` and `Sec-Fetch-Site`. Including them on all calls is safe — they do not break the availability endpoint.

### Hotel discovery by geo-search

Use the same availability endpoint but with `geoLocation` instead of `hotelMnemonics`. These two modes are mutually exclusive — do not include both.

Endpoint: `POST https://apis.ihg.com/availability/v3/hotels/offers?fieldset=summary,summary.rateRanges`

Request body:
```json
{
  "geoLocation": [{"latitude": -28.017742, "longitude": 153.425732}],
  "radius": 50,
  "maxRadius": 200,
  "incrementRadiusBy": 50,
  "distanceUnit": "KM",
  "distanceType": "STRAIGHT_LINE",
  "startDate": "YYYY-MM-DD",
  "endDate": "YYYY-MM-DD",
  "products": [{
    "productCode": "SR",
    "startDate": "YYYY-MM-DD",
    "endDate": "YYYY-MM-DD",
    "quantity": 1,
    "guestCounts": [{"otaCode": "AQC10", "count": ADULTS}]
  }]
}
```

Critical: `geoLocation` must be an **array** of coordinate objects. A single object not in an array returns 400.

Get coordinates from the destinations API first. Response includes `hotels[].hotelMnemonic`, `hotels[].brandCode`, `hotels[].distance`, and pricing.

### Availability API (by mnemonic codes)

Endpoint: `POST https://apis.ihg.com/availability/v3/hotels/offers?fieldset=summary,summary.rateRanges`

Request body:

From overseers-desk/magazines, MIT.

More from overseers-desk/magazines