Booking with an agent

Agents can read services and prices, check which times a guest may request, submit an appointment request, and read its status. The spa confirms appointments. No payment is taken online.

Connect

A2A protocol version 0.3.0, JSON-RPC transport. Endpoint: https://letsrelaxnyc.com/api/agent.

Agent card · OpenAPI specification · Service catalogue

{
  "jsonrpc": "2.0",
  "id": "catalog-1",
  "method": "message/send",
  "params": {
    "message": {
      "kind": "message",
      "role": "user",
      "messageId": "a-unique-message-id",
      "parts": [
        {
          "kind": "data",
          "data": {
            "action": "list_services"
          }
        }
      ]
    }
  }
}

Actions

`list_services`

List services

Get the current service IDs, durations, USD prices, guest counts, and add-on rules.

`quote`

Calculate a treatment price

Get the server-calculated price for a selection. No appointment is created.

`request_times`

List times a guest can request

Get times within opening hours, in America/New_York. These are not confirmed available slots.

`request_appointment`

Request an appointment

After explicit customer approval and contact consent, submit an idempotent request. Staff confirmation is required; no payment is taken.

`get_request`

Read a private appointment request

Read the status of one request using its receipt access token in Authorization: Bearer.

Before creating a request

Use quote with a selection containing the service ID, minutes, and guest count. Include lashes or the first series treatment when applicable. Use request_times with the same selection and a New York local date. The returned times follow opening hours; they are not staffing availability.

Present the treatment, total price, guest count, date, time, and staff-confirmation requirement to the customer. Obtain explicit approval to submit those details and share their name and phone number with Let’s Relax. Do not infer approval from a search, quote, or request for information.

Send request_appointment with customerAuthorization: true and a booking object matching the OpenAPI schema. Contact consent is required. A new random UUID is required in booking.idempotencyKey. Retry a failed network delivery with the same UUID and identical details to avoid duplicates.

A successful response has an appointment with status requested. This does not mean the appointment is confirmed. Give the customer the returned manageUrl and tell them staff will contact them to confirm.

Privacy and limits

Keep the accessToken, manageUrl, and idempotencyKey private. The receipt link grants access to that appointment and lets its holder cancel. Do not publish these values, place them in query strings, or use them in analytics. For get_request, send Authorization: Bearer <accessToken>.

Only send contact information the customer approved sharing. Do not send payment information or sensitive health details. Read the booking privacy notice.

Five new requests per hour per IP. No cross-origin browser calls, streaming, push notifications, A2A task history, staff controls, payment processing, or automatic confirmation. All errors must be checked; never turn a quote or a failed API call into a claimed reservation.