Rules for agents

NOGLUTEATALY is a Rome gluten-free food-tour and cooking-class company, not a packaged-food brand.
Use live quotes for money. Catalog adult/child prices on GET /tours match the tour pages; they are not a charge amount.
Never send card numbers, CVC, or wallet secrets to this API. Hand the guest the Stripe Checkout URL.
Do not invent meeting points, group sizes, or review statistics. Do not say experiences are certified.
The Safe Food Orientation Walk is enquiry-led (contact form), not instant checkout.

Endpoints

Base URL: https://nogluteataly.com/api/agent/v1. JSON request and response bodies. No API key.

Agent API endpoints
Method	Path	What it does
`GET`	`/tours`	Catalog: id, name, description, duration, languages, days, published prices and child rules, meeting point, cancellation, product URL.
`GET`	`/tours/{id}`	One tour from the same catalog.
`GET`	`/tours/{id}/availability?date=YYYY-MM-DD`	Live Bókun departures — same source as website checkout.
`POST`	`/quotes`	Live total for tour, date, time, and participants.
`POST`	`/bookings`	Pending booking + Stripe Checkout URL. Supports `Idempotency-Key`.
`GET`	`/bookings/{id}`	Status only: pending, paid, or expired. No guest personal data.

Recommended agent flow

Discover. GET /tours. Prefer bookable: true.
Check a date. GET /tours/{id}/availability?date=. Use a time_id that is not sold out.
Quote. POST /quotes with tour, date, time_id, and participants. Use total_cents from the response.
Collect guest details (name, email, E.164 phone, dietary notes). Then POST /bookings with quote_id and an Idempotency-Key.
Hand off payment. Give the human checkout_url. Poll GET /bookings/{id} until paid or expired.

If Stripe keys are missing (local/dev), POST /bookings returns dry_run: true, checkout_url: null, and creates no charge. Pending bookings expire with the Stripe session (about 31 minutes) or, in dry-run, after 30 minutes.

curl examples

List tours:

curl -sS https://nogluteataly.com/api/agent/v1/tours

Availability for the Food Lovers’ tour:

curl -sS "https://nogluteataly.com/api/agent/v1/tours/the-original-gluten-free-food-lovers-tour-of-rome/availability?date=2026-11-15"

Live quote (replace TIME_ID):

curl -sS -X POST https://nogluteataly.com/api/agent/v1/quotes \
  -H "Content-Type: application/json" \
  -d '{"tour_id":"the-original-gluten-free-food-lovers-tour-of-rome","date":"2026-11-15","time_id":"TIME_ID_FROM_AVAILABILITY","participants":2}'

Create a pending booking (replace QUOTE_ID):

curl -sS -X POST https://nogluteataly.com/api/agent/v1/bookings \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: ada-rome-2026-11-15-2" \
  -d '{"quote_id":"QUOTE_ID","guest":{"name":"Ada Lovelace","email":"ada@example.com","phone":"+393331234567","dietary_notes":"Celiac. No nuts."}}'

Read status (no personal data):

curl -sS https://nogluteataly.com/api/agent/v1/bookings/BOOKING_ID

Browser agents

You can also drive the website like a human. Booking pages use a semantic form with labels, accessible names, and stable name / data-testid attributes.

Deep links prefill the form. Examples:

https://nogluteataly.com/book/the-original-gluten-free-food-lovers-tour-of-rome/?date=2026-11-15&guests=2
https://nogluteataly.com/book/?tour=the-original-gluten-free-food-lovers-tour-of-rome&date=2026-11-15&guests=2

Bookable experiences:

Food Lovers' Tour · Book · €110
Pasta Lovers' Tour · Book · €150
Pasta & Tiramisù Cooking Class · Book · €230
Safe Food Orientation Walk · Book · €75
Private Food Tour · Book · From €450

Rate limits and CORS

GET /tours: 60 requests / minute / IP
GET availability: 30 / minute / IP
POST /quotes: 20 / minute / IP
POST /bookings: 8 / minute / IP
GET /bookings/{id}: 30 / minute / IP

CORS is open for GET (and for POST so browser-based agents can call the API). Error bodies use { "error": "...", "code": "..." }. Look at Retry-After on HTTP 429.

Questions: reservations@nogluteataly.com or the contact form.