Booking tracking information
The SWAT API offers a shareable tracking link for booking progress visibility. However, this unauthenticated API endpoint is vulnerable to unauthorized access if the simulationid and bookingid are known. The link displays booking information from both sender and recipient viewpoints, with differences in the displayed number of stops and status history, including scheduled times.