Build with OBO Travel

◆At a glance

This summary is here to help; the numbered sections below are the binding terms.

1Scope and acceptance

1.1 What the API is. “The API” means the OBO Travel Model Context Protocol server at https://onebookingonline.com/mcp, its tools and responses, the API keys issued for it, and the machine-readable descriptions of it (/.well-known/mcp.json, /llms.txt and /llms-full.txt). It is operated by OneBookingOnline Ltd. (“OBO”, “we”, “us”); our company details are in the Legal Notice.

1.2 Who “you” are. “You” means the person or organisation that connects to the API or builds the product that does (“your product”): an app, website, script, AI assistant, agent or platform. If you accept on behalf of an organisation, you confirm you may bind it. “End users” are the people your product serves.

1.3 Acceptance. By calling the API, creating an API key or building a product that calls it, you accept these terms. If you do not agree, please do not use the API.

1.4 How these terms fit with our other terms. Your use of the API is governed by these API terms. Our website Terms and Conditions govern bookings made on onebookingonline.com, and our Privacy Policy explains how we handle personal data. Where these API terms and the website terms differ about the API, these API terms apply. A separate written permission or agreement from us (section 16) applies over both.

1.5 Crawling is separate. Fetching our website pages is not use of the API. Automated access to the website follows our robots.txt and website terms; the API is the supported way for software to get our live hotel data.

2Access, accounts and keys

2.1 Keyless access. Anyone may connect without a key. Keyless calls share per-address limits (section 4).

2.2 Personal keys. Sign in on onebookingonline.com (a one-time e-mail code, no password) and create keys on your developer page. Creating a key involves no payment details and no further agreement beyond these terms. You can hold up to 2 active keys. Each key is shown once; we store only a fingerprint of it, so we cannot show it again or read it back to you. Send it in the X-OBO-Key header (or Authorization: Bearer).

2.3 Partner keys. If you run a platform that serves many people, write to us with the account e-mail and a short description of your product, and we can raise a key to a partner tier. Partner tiers change limits only; they add no cost and no obligations unless we agree something else in writing.

2.4 Keeping keys safe. Treat a key like a password. Keep it on your server or in a secrets store; never put it in a mobile app, browser code, a public repository, a prompt or a log. Do not share, sell or lend it. If a key may have leaked, revoke it on your developer page at once (requests with a revoked key are refused within a minute) and create a new one.

2.5 Your responsibility. You are responsible for the calls made with your keys and from your product, and for making sure your product and your end users follow these terms. Keep your account e-mail current: it is how we reach you about your keys and these terms.

3Free of charge

3.1 No fees. We charge nothing for access to the API, for keys or for partner tiers.

3.2 No automatic charges. We never ask for card or bank details for API use, and there is no overage billing: when a limit is reached, calls are refused until the window resets. You can never be charged by using the API more.

3.3 Commission and paid arrangements. Any commission, revenue share, referral fee or paid service exists only if both sides sign a separate written agreement that says so. Nothing in these terms, and nothing in using the API, creates a payment obligation for either side.

3.4 If this ever changes. If we ever introduce paid options, they will be opt-in, described on this page in advance (section 17), and never applied to existing keys without your express agreement.

4Usage limits

4.1 Current limits. These figures are read live from the server’s settings.

4.2 Live searches. A live search is a call that asks for current availability and prices: search_hotels, get_hotel_offers, find_deals, get_offer_policies, get_price_calendar, plan_trips, compare_hotels, search_flexible_dates, create_booking. Tools that fan out into several searches (for example find_deals and plan_trips) count as more than one. Other calls, such as destination lookups and hotel facts, count only towards the request limits.

4.3 Shared ceilings. To protect everyone, the whole service also has overall ceilings (currently 600 requests and 60 keyless live searches a minute across all callers). At busy moments a call can be refused even when your own limit is not reached; retry shortly.

4.4 When you hit a limit. The call fails with HTTP 429 and a Retry-After header, or the JSON-RPC error RATE_LIMITED with a retry hint. Back off and retry after the time given; do not retry in a tight loop.

4.5 No working around limits. Do not spread calls across addresses, accounts or keys, or disguise your client, to get more than your limits allow. If you need more, ask us (section 2.3).

4.6 Changes to limits. We may change limits, for example to protect the service or our partners’ systems. We will not lower a partner tier below what we agreed with you in writing without notice, except briefly to deal with abuse, an outage or a security issue.

5What you may build

5.1 Your licence. While you follow these terms, we give you a free, non-exclusive, non-transferable, revocable, worldwide licence to call the API and to show its results to your end users inside your product, for the purpose of helping them search, compare and choose hotels and book them on onebookingonline.com.

5.2 Examples that fit.

• An AI assistant or chatbot that answers “where should I stay in Lisbon in May under €150 a night?” with our live prices and booking links.
• A trip planner, travel blog widget or itinerary app that shows hotel options next to its own content.
• A personal agent, script or developer tool you run for yourself (Claude Code, Cursor, an automation).
• An internal prototype or a private test of a product, before you show it to the public.

5.3 What stays ours. We and our licensors keep all rights in the API, its data and our brand. You receive no rights except those this section grants. Your product, your code and your own content stay yours.

6Showing our results

6.1 Prices. Show a price as the API returns it: the amount with its currency, whether it is a total for the stay or a nightly figure, and any tax, fee or “pay at the hotel” notes that come with it. Do not add, round down, hide or recompute parts of a price in a way that could mislead. If you convert currencies yourself, say so.

6.2 Freshness. Prices and availability are live and can change. Do not present a price as current once it is older than 30 minutes, or once the user’s session has ended, whichever is sooner; fetch it again instead. A short note such as “live price, confirmed at checkout” is enough.

6.3 Cancellation terms. Before describing an offer as refundable, free to cancel or bookable, confirm it with get_offer_policies and show the terms it returns, including deadlines.

6.4 Attribution. Name OBO Travel as the source wherever you show our prices or offers, close to them, for example:

In a voice or chat answer, saying “prices from OBO Travel” with the booking link is enough.

6.5 Booking links. Use the booking_url and hotel links exactly as the API returns them. You may open them in a new tab, an in-app browser or a webview. Do not shorten, cloak, frame with your own checkout, strip their parameters or route them through a redirect that changes them; they carry the dates, guests, price and attribution your end user expects.

6.6 No misleading presentation. Do not suggest that we endorse your product, that you are OBO, or that a price is guaranteed when it is not. Do not edit hotel names, ratings, review scores or descriptions in a way that changes their meaning.

7Bookings stay with OBO

7.1 Read-only. The API cannot create bookings or take payments. All bookings are made by the end user on onebookingonline.com through our booking links.

7.2 Who the customer contracts with. A booking made through our links is a contract between the end user and OneBookingOnline Ltd. under our website Terms and Conditions. You are not a party to it and do not act as our agent.

7.3 What you must not do. Do not collect payment, card details, guest names or passport details for a booking on our behalf, do not present yourself as the seller of our rates, and do not book on behalf of end users through automated checkout of our website.

7.4 Support. Questions about a booking go to us. If an end user contacts you about one, point them to onebookingonline.com/contact.

8What is not allowed

8.1 Going around us. Do not use the API to find out which hotels, rates or partners are behind our offers in order to bypass OBO, and do not market our rates under another name.

8.2 Security issues. If you find a security issue, tell us at [email protected] with “Security” in the subject and give us a fair chance to fix it before you share it. Do not access data that is not yours.

9Caching and storage

9.1 Prices and offers. You may keep prices, offers, offer ids and booking links in memory or a short-lived cache for as long as the end user’s session needs them, and never longer than 30 minutes. Offer ids expire after 30 minutes in any case.

9.2 Hotel facts. You may keep descriptive results (hotel names, locations, facilities, descriptions, ratings) for the end user’s session, and up to 24 hours in a technical cache that only serves repeat requests. Do not combine them into a lasting database or index.

9.3 Identifiers you may keep. You may keep the hotel_token values, hotel links and destination names an end user saved (for example in a shortlist or favourites) so you can look them up again later through the API.

9.4 Longer storage. Storing anything else for longer needs our written permission (section 16).

10AI assistants and training

10.1 Answering users. An AI model in your product may read API results in its context to answer, summarise, compare or recommend for the end user it is serving, and may quote our prices and facts in its answer, following section 6.

10.2 Hotel content is not training data. Hotel descriptions, photos, room details, reviews and prices come from the hotels and our partners, and we cannot pass on rights to train on them. You may not use them, or logs, transcripts or caches containing them, to train, fine-tune or distil a model, or collect them into a dataset or retrieval index that outlives the session. This applies whether you do it yourself or a model provider does it on your traffic: if your provider trains on your traffic by default, switch that off for API results.

10.3 Testing and improving your product. You may use logs of your own calls to test, evaluate and improve how your product and its models use the API, for example which tool to call and how to read the results, as long as those logs are not shared as a dataset and are deleted when no longer needed for that purpose.

10.4 Our own content. Our editorial content (travel guides, blog articles, destination facts, price trend summaries) and facts about OBO Travel as a service may be used to train models, provided OBO Travel is credited where the model cites them.

10.5 Accuracy in answers. Models can make mistakes. Do not let your product invent prices, availability or cancellation terms that the API did not return, and present our live prices as subject to confirmation at checkout.

10.6 Agents acting for a person. Agents that use the API on behalf of an individual are welcome. They must not complete bookings on our website automatically; they hand the end user our booking link so the user books and pays themselves.

11Name, logo and attribution

11.1 Using our name. You may use the name “OBO Travel” and the domain onebookingonline.com to attribute our data and to say truthfully that your product uses our API. You may use our logo for the same purpose, unaltered and not larger or more prominent than your own branding.

11.2 What needs our consent. Press releases, case studies, “official partner” wording, co-branded campaigns and use of our name in your product or domain name need our written consent.

11.3 Using your name. We will not name you as a partner or customer in public without your consent.

12Privacy and data

12.1 What we record. For each call we record the tool name, timing, outcome, the client name and version your software reports, the key it used (if any) and a one-way hash of the calling address, kept for 90 days. Supplier requests triggered by a search are kept in our technical audit log with the search details and the requesting address for 14 days. Details are in our Privacy Policy.

12.2 Do not send personal data. The API does not need names, e-mail addresses or other personal data about your end users. Do not put them in queries or free-text fields.

12.3 Your end users. You are responsible for your own product’s privacy notice and for any personal data you process. When an end user follows a booking link, the booking and the personal data given at checkout are handled by us as an independent controller under our Privacy Policy.

12.4 Your account data. We use your account e-mail and key metadata to run your keys, contact you about them and enforce these terms.

13Availability and changes

13.1 No service level. The API is provided “as is” and “as available”, without a guaranteed uptime, response time or result count. Searches depend on third-party systems and can return partial results or time out; handle that gracefully.

13.2 Versions and changes. We add tools and fields over time and try to keep existing ones working. The current server version is published in /.well-known/mcp.json. Where we can, we announce changes that break existing integrations at least 30 days ahead in our agent documentation and by e-mail to key holders. We may change things faster when the law, security or a partner requires it.

13.3 Ending the API. We may stop offering the API. If we do, we will give at least 60 days’ notice on this page and by e-mail to key holders, unless that is impossible.

14Accuracy and liability

14.1 Data accuracy. We take care to return accurate data, but hotel details, prices and availability come from many sources and can be out of date or wrong. A price is confirmed only when the end user completes checkout on our website.

14.2 Limitation. To the extent the law allows, OBO is not liable for indirect or consequential loss, lost profits, revenue or data, or for loss caused by the unavailability of the API, arising from your use of the API.

14.3 What is not limited. Nothing in these terms limits liability that cannot be limited by law, such as liability for fraud, wilful misconduct or gross negligence, or for death or personal injury caused by negligence, nor the rights end users have as consumers when they book with us.

14.4 Your product. You are responsible for your product and what it tells its users. You will compensate OBO for third-party claims that arise from your breach of these terms or from your product, except where we caused the loss.

15Suspension and ending

15.1 By you. You may stop using the API and revoke your keys at any time.

15.2 By us. We may throttle, suspend or revoke a key or block a caller if these terms are broken, if traffic threatens the service or our partners’ systems, or if the law requires it. Where it is reasonable, we warn you first and give you a chance to fix the problem.

15.3 Afterwards. When your access ends, stop calling the API and delete the API results you still hold, except the identifiers section 9.3 lets you keep and copies the law requires you to keep. Sections that by their nature should continue (for example 8, 9, 10, 14 and 18) continue to apply.

16Written permissions

16.1 Prior written consent. Our copyright notice says our content may not be reproduced without prior written consent. These terms are that consent for the uses they allow. For other uses, a permission we give you in writing (an e-mail from an onebookingonline.com address is enough) is that consent for the scope it describes.

16.2 Order of precedence. Where they differ, a signed agreement between you and OBO applies first, then a written permission we gave you, then these API terms, then our website terms.

16.3 Scope stays as written. A written permission covers only what it describes (for example a private test, a display format or a storage period). Anything outside it falls back to these terms.

17Changes to these terms

17.1 Notice. We may update these terms. For changes that matter to you (for example new restrictions or fees), we will publish the new version here and e-mail key holders at least 30 days before it applies. Small corrections and changes that only give you more room apply when published.

17.2 Your choice. If you do not agree with a change, stop using the API before it applies. Continuing to use the API after that date means you accept the new version.

18Law and contact

18.1 Governing law. These terms are governed by the law of the country in which OneBookingOnline Ltd. is registered, as shown in our Legal Notice. If you are a consumer, you keep the protection of the mandatory law of the country where you live.

18.2 Disputes. Please contact us first; most questions are settled quickly that way. Mandatory rules on courts and consumer dispute resolution are not affected.

18.3 General. If a provision of these terms is invalid, the rest stay in force. Not enforcing a right is not a waiver of it. You may not transfer these terms without our consent; we may transfer them to a company that takes over the API.

18.4 Contact. E-mail [email protected] with “API” in the subject, or use our contact form.

↻Version history