Geolander publishes a small public reservation API used by the booking form on geo-lander.com. It supports read-only, date-specific quotes and a customer-approved booking-request handoff. The API does not confirm vehicle availability, accept payment, expose customer records, or provide webhooks. Geolander also operates OAuth-protected read-only MCP and A2A interfaces for verified fleet, policy, and quote retrieval.
Machine-readable resources
- Geolander Reservation API — OpenAPI 3.1 specification
- Geolander API catalog — RFC 9727 Linkset discovery
- Geolander Agent API — RFC 8414 OAuth discovery
- Geolander Agent API — RFC 9728 protected-resource metadata
- Authentication guide for approved agent clients
- Geolander ARD capability catalog
- Geolander Agent Skills discovery index
- Geolander Rental Tools MCP server card
- Geolander Rental Agent — A2A v1.0 Agent Card
- Geolander Web Bot Auth public key directory
- Agent instructions and when-to-use guidance
- Geolander site and fleet context for language models
- Live machine-readable fleet price tables
- WordPress REST API index
Authentication and safe use
The customer-facing /wp-json/geolander/v1/ routes do not require an account. Authenticated clients operated by Geolander team members use the mirrored /wp-json/geolander-agent/v1/ routes through Cloudflare Access Managed OAuth. The MCP endpoint at /wp-json/geolander-agent/v1/mcp and A2A v1.0 JSON-RPC endpoint at /wp-json/geolander-agent/v1/a2a expose read-only fleet, policy, and quote capabilities. REST quote is read-only. REST checkout is rate-limited and creates an internal booking request, so an agent must obtain explicit user approval and a valid customer name and email before calling it. The returned WhatsApp link continues the conversation with Geolander staff. A booking request is not a confirmed reservation; staff confirm availability and the 10% prepayment separately.
A2A request format
A2A clients send JSON-RPC 2.0 SendMessage requests with A2A-Version: 1.0. Use a structured application/json data part whose skill is fleet-discovery, rental-policy, or rental-quote. The quote skill also needs a published car ID, from and to dates, plus pickup and return location identifiers. The response is an immediate A2A agent Message with both a text summary and structured data.
Signed outbound agent requests
Geolander-operated WordPress agents opt in to IETF Web Bot Auth by passing glc_web_bot_auth => true to wp_remote_get() or wp_remote_post(), or by using a Geolander-Agent/ User-Agent. The HTTP client then adds Signature-Agent, Signature-Input, and Signature headers. The Ed25519 private key is held in the Railway secret GLC_WEB_BOT_AUTH_PRIVATE_KEY; only its public JWK is published.
Support
Questions about the API or booking data should be sent to [email protected]. Do not send SMTP keys, payment credentials, passport data, or other secrets through public API fields.