Developers

An API for trips that have to work on the day

REST endpoints, webhooks and an MCP server for the same itineraries, routes, quotes, bookings and signals our modules run on. Versioned, predictable, and available in a sandbox by request.

Blueprint cutaway of a desert road with tidy underground utility lines and an open maintenance hatch.
Field noteOur APIs are the utilities under the road: boring on purpose, documented everywhere.

API surface

Five resources, one data model

Everything lives under https://api.novadventure.com/v1 and speaks JSON. Each resource is the same object the platform modules use, not a reporting copy.

Itineraries

Create, read and version multi-day plans. A re-plan is a new version, never an overwrite, so you can always show what changed. /v1/itineraries

Routes

Solve a day or a whole trip against opening windows, travel times, energy budgets, accessibility and weather exposure. Every decision comes back with a reason. /v1/routes

Quotes

Price a route or itinerary with live supplier rates, hold inventory for a set window and expire cleanly. /v1/quotes

Bookings

Confirm a quote, track supplier confirmations, fetch vouchers and handle changes and cancellations. /v1/bookings

Signals

Read demand forecasts, cancellation risk scores with their reasons and soft-week alerts for your inventory. /v1/signals

Webhooks

Subscribe to events such as route.replanned, booking.confirmed and signal.risk_changed instead of polling. /v1/webhooks

Quick start

Three calls: get a token, solve a day, and listen for what happens next. Every example runs against the sandbox once you have credentials.

1. Get an access token

Server-to-server integrations use the OAuth 2.0 client credentials grant. Tokens last an hour; request only the scopes you need.

curl -X POST https://api.novadventure.com/v1/oauth/token \
  -u "$NOVA_CLIENT_ID:$NOVA_CLIENT_SECRET" \
  -d grant_type=client_credentials \
  -d scope="routes:write quotes:write bookings:read"
{
  "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "routes:write quotes:write bookings:read"
}

For back-office scripts, an API key works too. Send it as a bearer token. Keys are bound to one environment: a sandbox key is refused by production, and the reverse.

2. Solve a day

Send the stops and the traveler’s limits. You get back a feasible schedule, with a reason for every placement.

curl -X POST https://api.novadventure.com/v1/routes \
  -H "Authorization: Bearer $NOVA_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 8c1f2a7e-5d3b-4e0a-9f61-2b7d4c9a0e13" \
  -d '{
    "date": "2026-11-14",
    "start": { "lat": 35.687, "lng": -105.938, "time": "08:30" },
    "travelers": [{ "energy_budget": "moderate", "max_walk_km": 8 }],
    "stops": [
      { "product_id": "prd_sbx_mesa_hike", "duration_min": 150, "exposure": "high" },
      { "product_id": "prd_sbx_pottery_studio", "duration_min": 90 },
      { "product_id": "prd_sbx_cooking_class", "fixed_start": "17:30" }
    ],
    "weather": "forecast"
  }'
{
  "id": "rte_7Kq2mW",
  "version": 1,
  "status": "feasible",
  "schedule": [
    { "start": "08:30", "product_id": "prd_sbx_mesa_hike",
      "reason": "Exposed trail placed first; storm cells forecast after 13:40." },
    { "start": "12:15", "type": "meal",
      "reason": "Lunch near the studio keeps the next leg under 15 minutes." },
    { "start": "13:45", "product_id": "prd_sbx_pottery_studio",
      "reason": "Indoor stop placed in the storm window." },
    { "start": "17:30", "product_id": "prd_sbx_cooking_class",
      "reason": "Fixed start kept." }
  ],
  "energy": { "budget": "moderate", "used": 0.74 },
  "warnings": []
}

3. Listen for changes

Register an endpoint and we’ll POST events as they happen: signed, retried, and safe to process twice.

curl -X POST https://api.novadventure.com/v1/webhooks \
  -H "Authorization: Bearer $NOVA_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://ops.internal/nova/events",
    "events": ["route.replanned", "booking.confirmed", "booking.exception"]
  }'
{
  "id": "evt_3Rb81x",
  "type": "route.replanned",
  "created": "2026-11-14T20:41:07Z",
  "data": {
    "route_id": "rte_7Kq2mW",
    "version": 2,
    "trigger": "weather.storm_cell",
    "status": "awaiting_approval"
  }
}

Each delivery carries a Nova-Signature header, an HMAC-SHA256 of the timestamp and raw body made with your endpoint’s signing secret. Verify it, reject anything older than five minutes, and use the event id to ignore duplicates. Failed deliveries retry with exponential backoff for 24 hours.

Re-plans arrive as awaiting_approval by default. Your product, or a person on your team, confirms them with POST /v1/routes/{id}/versions/{version}/approve. We draft; you decide.

MCP for AI agents

Agent Gateway exposes a curated set of tools over the Model Context Protocol at https://api.novadventure.com/v1/mcp, scoped to your own catalog.

Tool What it does Default
search_products Find bookable products by place, date, interests and access needs On
check_availability Live availability and total price for a product and party On
plan_day Route a day through the Route Engine, with reasons On
create_quote Price and hold a plan for a short window Off
request_booking Book a held quote after explicit traveler confirmation Off

Write tools stay off until you enable them, with spending limits and confirmation rules you set. Every tool call is logged with the calling agent and attributed through to any booking it leads to.

Errors

Errors share one shape everywhere, with a stable type to branch on and a request_id to quote to support@novadventure.com.

{
  "error": {
    "type": "constraint_conflict",
    "message": "prd_sbx_cooking_class has a fixed start at 17:30 that cannot be reached within the traveler's walking limit.",
    "request_id": "req_9Fh2Lp"
  }
}

Conventions

The rules every endpoint follows

Authentication

OAuth 2.0 client credentials for services, API keys for scripts. Both are scoped per environment and per resource: routes:write doesn't imply bookings:write.

Environments

Sandbox and production are fully separate, with separate credentials and data. A sandbox key is rejected by production, and nothing in the sandbox can reach a real supplier.

Rate limits

600 requests a minute per client in production, 60 in the sandbox. Responses carry RateLimit-Remaining and RateLimit-Reset; a 429 comes with Retry-After.

Versioning

The major version lives in the path. Additive changes ship without notice. Breaking changes wait for a new major version, announced at least six months ahead with Deprecation and Sunset headers.

Idempotency

Send an Idempotency-Key header with any write. Retries within 24 hours return the original result instead of a second quote or booking.

Pagination and filters

Lists are cursor-paginated with limit and cursor, and filter by date range, status and product. Timestamps are ISO 8601 in UTC.

Sandbox

A sandbox with a small desert in it

Sandbox access is by request, so we can set you up with the right scopes and a person to ask. You get a synthetic high-desert region, with lodges, guided hikes, a pottery studio, a cooking school, shuttle routes and a weather feed you can script, so you can test re-planning without bothering a real supplier.

  • Sandbox client credentials and API keys, valid in the sandbox only
  • A synthetic catalog of about 120 products with realistic opening windows, capacity and policies
  • Scriptable storms, closures and supplier no-shows that trigger re-plans and webhooks
  • An MCP endpoint wired to the same catalog, for testing AI agents end to end
  • An OpenAPI 3.1 description you can generate typed clients from
Request sandbox access
A sandbox holding a miniature desert landscape with toy routes and flags.
Field noteEvery integration starts in the sandbox, where breaking things is the point.

How it works

From sandbox to production

  1. 01

    Request access

    Day 1

    Email welcome@novadventure.com with what you're building and which resources you need. We reply within one business day.

  2. 02

    Scoping call

    Week 1

    Thirty minutes with one of our engineers to agree scopes, webhook events and the data you'll need.

  3. 03

    Build in the sandbox

    As long as you need

    Credentials, synthetic catalog and scriptable events. Ask questions as you go; a named engineer answers them.

  4. 04

    Production review

    About a week

    We review your scopes, retry and webhook handling, and how your product shows travelers what the engine decided and why.

  5. 05

    Production credentials

    On approval

    Issued per environment, with rotation and revocation tested together before the first live call.

Questions

Frequently asked questions

Is the API self-serve?

No. Sandbox and production access are both by request, so every integration starts with a conversation about scopes and data. Email welcome@novadventure.com to begin.

Do you publish SDKs?

We provide an OpenAPI 3.1 description with sandbox access, which generates typed clients in most languages, and we maintain code samples in curl, JavaScript and Python.

How is MCP access different from the REST API?

The MCP server exposes a small, curated set of tools designed for AI agents, with plain-language descriptions and tighter limits. The REST API is for your own software and covers the full resource model.

Can AI agents book through MCP?

Only if you allow it. Write tools are off by default. Turning them on in Agent Gateway requires agent-scoped credentials, spending limits and explicit traveler confirmation.

How is data protected?

Data is encrypted in transit and at rest, access follows least privilege, and every credential is scoped to one environment. Security & trust describes our practices in detail.

Which of our systems can feed the API?

Property management systems, channel managers, reservation systems, CRMs and supplier feeds, connected through REST APIs, webhooks or CSV/SFTP. See Integrations.

Building something on top of trips?

Tell us what you're building. We'll set up a sandbox and pair you with an engineer who has made the same calls.