Itineraries
Create, read and version multi-day plans. A re-plan is a new version, never an overwrite, so you can always show what changed. /v1/itineraries
Developers
REST endpoints, webhooks and an MCP server for the same itineraries, routes, quotes, bookings and signals our modules run on. Versioned, predictable, and available in a sandbox by request.

API surface
Everything lives under https://api.novadventure.com/v1 and speaks JSON. Each resource is the same object the platform modules use, not a reporting copy.
Create, read and version multi-day plans. A re-plan is a new version, never an overwrite, so you can always show what changed. /v1/itineraries
Solve a day or a whole trip against opening windows, travel times, energy budgets, accessibility and weather exposure. Every decision comes back with a reason. /v1/routes
Price a route or itinerary with live supplier rates, hold inventory for a set window and expire cleanly. /v1/quotes
Confirm a quote, track supplier confirmations, fetch vouchers and handle changes and cancellations. /v1/bookings
Read demand forecasts, cancellation risk scores with their reasons and soft-week alerts for your inventory. /v1/signals
Subscribe to events such as route.replanned, booking.confirmed and signal.risk_changed instead of polling. /v1/webhooks
Three calls: get a token, solve a day, and listen for what happens next. Every example runs against the sandbox once you have credentials.
Server-to-server integrations use the OAuth 2.0 client credentials grant. Tokens last an hour; request only the scopes you need.
curl -X POST https://api.novadventure.com/v1/oauth/token \
-u "$NOVA_CLIENT_ID:$NOVA_CLIENT_SECRET" \
-d grant_type=client_credentials \
-d scope="routes:write quotes:write bookings:read"
{
"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
"token_type": "Bearer",
"expires_in": 3600,
"scope": "routes:write quotes:write bookings:read"
}
For back-office scripts, an API key works too. Send it as a bearer token. Keys are bound to one environment: a sandbox key is refused by production, and the reverse.
Send the stops and the traveler’s limits. You get back a feasible schedule, with a reason for every placement.
curl -X POST https://api.novadventure.com/v1/routes \
-H "Authorization: Bearer $NOVA_TOKEN" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 8c1f2a7e-5d3b-4e0a-9f61-2b7d4c9a0e13" \
-d '{
"date": "2026-11-14",
"start": { "lat": 35.687, "lng": -105.938, "time": "08:30" },
"travelers": [{ "energy_budget": "moderate", "max_walk_km": 8 }],
"stops": [
{ "product_id": "prd_sbx_mesa_hike", "duration_min": 150, "exposure": "high" },
{ "product_id": "prd_sbx_pottery_studio", "duration_min": 90 },
{ "product_id": "prd_sbx_cooking_class", "fixed_start": "17:30" }
],
"weather": "forecast"
}'
{
"id": "rte_7Kq2mW",
"version": 1,
"status": "feasible",
"schedule": [
{ "start": "08:30", "product_id": "prd_sbx_mesa_hike",
"reason": "Exposed trail placed first; storm cells forecast after 13:40." },
{ "start": "12:15", "type": "meal",
"reason": "Lunch near the studio keeps the next leg under 15 minutes." },
{ "start": "13:45", "product_id": "prd_sbx_pottery_studio",
"reason": "Indoor stop placed in the storm window." },
{ "start": "17:30", "product_id": "prd_sbx_cooking_class",
"reason": "Fixed start kept." }
],
"energy": { "budget": "moderate", "used": 0.74 },
"warnings": []
}
Register an endpoint and we’ll POST events as they happen: signed, retried, and safe to process twice.
curl -X POST https://api.novadventure.com/v1/webhooks \
-H "Authorization: Bearer $NOVA_TOKEN" \
-H "Content-Type: application/json" \
-d '{
"url": "https://ops.internal/nova/events",
"events": ["route.replanned", "booking.confirmed", "booking.exception"]
}'
{
"id": "evt_3Rb81x",
"type": "route.replanned",
"created": "2026-11-14T20:41:07Z",
"data": {
"route_id": "rte_7Kq2mW",
"version": 2,
"trigger": "weather.storm_cell",
"status": "awaiting_approval"
}
}
Each delivery carries a Nova-Signature header, an HMAC-SHA256 of the timestamp and raw body made with your endpoint’s signing secret. Verify it, reject anything older than five minutes, and use the event id to ignore duplicates. Failed deliveries retry with exponential backoff for 24 hours.
Re-plans arrive as awaiting_approval by default. Your product, or a person on your team, confirms them with POST /v1/routes/{id}/versions/{version}/approve. We draft; you decide.
Agent Gateway exposes a curated set of tools over the Model Context Protocol at https://api.novadventure.com/v1/mcp, scoped to your own catalog.
| Tool | What it does | Default |
|---|---|---|
search_products |
Find bookable products by place, date, interests and access needs | On |
check_availability |
Live availability and total price for a product and party | On |
plan_day |
Route a day through the Route Engine, with reasons | On |
create_quote |
Price and hold a plan for a short window | Off |
request_booking |
Book a held quote after explicit traveler confirmation | Off |
Write tools stay off until you enable them, with spending limits and confirmation rules you set. Every tool call is logged with the calling agent and attributed through to any booking it leads to.
Errors share one shape everywhere, with a stable type to branch on and a request_id to quote to support@novadventure.com.
{
"error": {
"type": "constraint_conflict",
"message": "prd_sbx_cooking_class has a fixed start at 17:30 that cannot be reached within the traveler's walking limit.",
"request_id": "req_9Fh2Lp"
}
}
Conventions
OAuth 2.0 client credentials for services, API keys for scripts. Both are scoped per environment and per resource: routes:write doesn't imply bookings:write.
Sandbox and production are fully separate, with separate credentials and data. A sandbox key is rejected by production, and nothing in the sandbox can reach a real supplier.
600 requests a minute per client in production, 60 in the sandbox. Responses carry RateLimit-Remaining and RateLimit-Reset; a 429 comes with Retry-After.
The major version lives in the path. Additive changes ship without notice. Breaking changes wait for a new major version, announced at least six months ahead with Deprecation and Sunset headers.
Send an Idempotency-Key header with any write. Retries within 24 hours return the original result instead of a second quote or booking.
Lists are cursor-paginated with limit and cursor, and filter by date range, status and product. Timestamps are ISO 8601 in UTC.
Sandbox
Sandbox access is by request, so we can set you up with the right scopes and a person to ask. You get a synthetic high-desert region, with lodges, guided hikes, a pottery studio, a cooking school, shuttle routes and a weather feed you can script, so you can test re-planning without bothering a real supplier.

How it works
Email welcome@novadventure.com with what you're building and which resources you need. We reply within one business day.
Thirty minutes with one of our engineers to agree scopes, webhook events and the data you'll need.
Credentials, synthetic catalog and scriptable events. Ask questions as you go; a named engineer answers them.
We review your scopes, retry and webhook handling, and how your product shows travelers what the engine decided and why.
Issued per environment, with rotation and revocation tested together before the first live call.
Questions
No. Sandbox and production access are both by request, so every integration starts with a conversation about scopes and data. Email welcome@novadventure.com to begin.
We provide an OpenAPI 3.1 description with sandbox access, which generates typed clients in most languages, and we maintain code samples in curl, JavaScript and Python.
The MCP server exposes a small, curated set of tools designed for AI agents, with plain-language descriptions and tighter limits. The REST API is for your own software and covers the full resource model.
Only if you allow it. Write tools are off by default. Turning them on in Agent Gateway requires agent-scoped credentials, spending limits and explicit traveler confirmation.
Data is encrypted in transit and at rest, access follows least privilege, and every credential is scoped to one environment. Security & trust describes our practices in detail.
Property management systems, channel managers, reservation systems, CRMs and supplier feeds, connected through REST APIs, webhooks or CSV/SFTP. See Integrations.
Related
Tell us what you're building. We'll set up a sandbox and pair you with an engineer who has made the same calls.