01
Token
POST /auth/token with the broker's credentials.
For developers
NoloForWeb Broker API: technical reference
The Broker API is the REST interface that brokers, agencies and tour operators use to read the catalogue, availability and prices of a rental company running NoloForWeb and to book into its calendar. The rental company switches on each broker with its own credentials and permissions; test credentials on request.
REST over HTTPS, JSON Idempotent bookings HMAC-SHA256 signed webhooks
Connection
Base URL, authentication and limits
| Item | Value |
|---|---|
| Base URL | https://brokerapi.rilogi.it/broker/v1 |
| Authentication | Client credentials at POST /auth/token (HTTP Basic, form or JSON with client_id brk_… and client_secret). Response: opaque access_token, token_type: Bearer, expires_in, scope. |
| Session | 60 minutes, no refresh: when it expires you request a new token. At most 20 active sessions per credential; POST /auth/revoke closes the current one. |
| Company | Derived from the credential only: X-Tenant-* headers are ignored. |
| Permissions | By area (catalogue, availability, bookings, finance, account) and level (read, write, manage), granted by the rental company; in scopes they look like bookings:write. |
| Security | Credential locked for 15 minutes after 5 failed attempts, optional IP allowlist, secret rotation with a grace period. |
| Limits | 120 requests a minute per broker (the rental company can change it), 600 per company, 10 a minute per IP on /auth/token. Beyond that: 429 with Retry-After. |
| Errors | JSON {error, message, correlationId}; every response carries X-Correlation-Id. Login errors follow the OAuth format {error, error_description}. |
Endpoints
Available calls
| Method and path | Permission | Purpose |
|---|---|---|
GET /locations | Catalogue, read | Branches enabled for the broker, with address and airport yes/no |
GET /vehicle-groups | Catalogue, read | Vehicle groups with up to three sample models |
GET /extras?culture= | Catalogue, read | Bookable extras, described in the requested language |
POST /availability | Availability, read | Offers priced from the rental company's rates, with a signed offerToken valid for 15 minutes |
GET /images/{token} | Signed link | Photos of the models in the offers, with ETag and one-day caching |
POST /bookings | Bookings, write | Books from an offerToken; Idempotency-Key required; returns 201 with Location |
GET /bookings/{brokerReference} | Bookings, read | Reads a booking |
PATCH /bookings/{brokerReference} | Bookings, write | Changes dates, extras, driver or voucher |
POST /bookings/{brokerReference}/cancel | Bookings, manage | Cancels, with any penalty; repeated, it returns the same result |
GET /statements?from=&to= | Finance, read | Broker account statement, at most one year at a time |
GET /invoices | Finance, read | Invoices issued to the broker |
Lists are not paginated. There is no endpoint that lists bookings: status changes arrive through webhooks.
Idempotency and webhooks
No duplicates, every change signed
| Item | How it works |
|---|---|
Idempotency-Key | 1 to 100 ASCII characters, unique per broker, valid for 24 hours. Same key and body: the stored response comes back with Idempotent-Replayed: true. Different body: 422 idempotency_key_reuse. Request still running: 409. |
| Events | booking.modified, booking.cancelled, booking.no_show, rental.closed |
| Envelope | JSON {eventId, type, occurredAt, source, data}, with source BACKOFFICE or BROKER_API; headers X-N4W-Event-Id and X-N4W-Event-Type |
| Signature | X-N4W-Signature: t=<unix>,v1=<hex>, where hex is the HMAC-SHA256, keyed with the whsec_… secret, of <t>. followed by the raw UTF-8 body. We recommend rejecting timestamps older than 5 minutes. |
| Delivery | https URLs only. Any 2xx counts as received, 10-second timeout; up to 10 attempts from 1 minute to 24 hours, with the same eventId (the signature timestamp is new on each attempt). |
The webhook URL and its secret are configured by the rental company in the rental system: there is no endpoint to register them.
The flow
A booking in four calls
02
Availability
POST /availability with branches, dates and times: each offer has a price and an offerToken valid for 15 minutes.
03
Booking
POST /bookings with the offerToken, the driver's details and an Idempotency-Key: a retry never creates a duplicate.
04
Updates
Changes, cancellations, no-shows and rental closure arrive as signed webhooks.
Need test credentials?
Write to us from the Contact page: full specifications and test credentials on request.