Documentation

1. Forwarding emails

Your account has a private forwarding address, shown on the dashboard overview. It looks like itinerary+<alias>@in.loominator.io. Forward confirmation emails to it inline or as an attachment; both are handled, and the original is kept either way.

Only mail from a verified sender is processed. Your sign-in address is verified automatically. Add other addresses on the settings page, or verify a whole domain once with a TXT record, a meta tag or a well-known file. Anything from an unverified address is held and shown on the dashboard, never counted.

Microsoft 365 blocks automatic external forwarding rules by default; forwarding by hand works without changes. Gmail's "forward as attachment" is the most reliable option for emails with complex layouts.

2. Authentication

Create an API key on the settings page. It is shown once. Send it as a bearer token on every request to https://api.loominator.io.

curl -H "Authorization: Bearer lm_live_…" \
  https://api.loominator.io/v1/itineraries

Every authenticated response carries RateLimit-Policy, RateLimit and Loominator-Blocks headers describing the period, what remains, and how many extra blocks are open. Reads never consume quota.

3. Webhooks

Register an endpoint on the webhooks page to be told when a run finishes. Deliveries are signed with Loominator-Signature: v1=<hex HMAC-SHA256> over <timestamp>.<body>, retried with backoff for up to a day, and every attempt is stored. The payload's id is the delivery id; use it as an idempotency key.

Errors from the API are application/problem+json. A 429 means the period quota or your block cap is exhausted and includes Retry-After; raise the cap on the billing page to continue.