Critical-risk tools in GetMyHotels
3 of the 18 tools in GetMyHotels are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
cancel_bookingDestructiveCancel one of the signed-in user's bookings. Requires the 6-digit `verificationCode` from `request_booking_action_code`. This may be irreversible and can trigger a refund per po...
-
create_checkoutFinancialCreate a secure checkout for a chosen hotel room and return a getmyhotels.com URL where the guest completes payment. This does NOT charge the card — the guest pays on the hosted...
-
create_one_click_checkoutFinancialCreate a checkout for the signed-in user with a saved card pre-selected, and return a getmyhotels.com URL where they confirm + pay in one click. Does NOT charge the card — the u...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.