TripadvisorCAUTION

AI-powered travel hacking and search with cash, points, miles, and award flights. Drop-in skills and MCP servers for Claude, Codex, and OpenCode.

The instruction file, verbatim from the audited commit — this is the text the model reads, and the surface the audit's instruction layer examines. Quoted here so you can judge it without cloning anything.

---
name: tripadvisor
description: TripAdvisor Content API for hotel ratings, restaurant search, attraction reviews, rankings, and nearby locations. Use when evaluating hotels or researching destinations. 5K calls/month.
category: destinations
summary: Hotel ratings, restaurant search, attraction reviews, nearby search. 5K calls/month.
api_key: TripAdvisor
license: MIT
compatibility: opencode
metadata:
  type: integration
  platform: any
---

# TripAdvisor Content API

Search and retrieve hotel, restaurant, and attraction data from TripAdvisor. Ratings, rankings, reviews, photos, amenities, subratings, trip types, awards.

**Base URL:** `https://api.content.tripadvisor.com/api/v1`

**Rate limit:** 50 calls per second.

**Monthly quota:** 5,000 API calls per month. Each curl request = 1 call. A full hotel lookup (search + details + reviews + photos) = 4 calls. Budget accordingly. Prefer search + details (2 calls) and only fetch reviews/photos when specifically needed.

**API limits:** Up to 10 results per search. Up to 5 reviews and 5 photos per location.

## Authentication

> **First-time setup gotcha:** TripAdvisor requires whitelisting your outbound IP at https://www.tripadvisor.com/developers before the key works. Without this, every call returns `User is not authorized to access this resource with an explicit deny`. This is the #1 first-time failure mode. **Whitelist before troubleshooting auth or quotas.**
>
> - **How to find your current IP:** `curl ifconfig.me`
> - **Propagation:** changes take 1-5 minutes (AWS edge cache).
> - **Multi-IP:** residential CGNAT, VPN exits, and different networks each need their own entry.
> - **No Referer alternative:** the free tier requires IP whitelisting; HTTP Referer restriction is not available.
> - **Verify which key is which:** the developer portal shows the last 4 chars only (e.g. "Ends in 11D7"), so you can confirm without exposing the secret.

Set `TRIPADVISOR_API_KEY` in your `.env` file:

```bash
# In .env (gitignored)
TRIPADVISOR_API_KEY=your_key_here
```

Then source it before calling:

```bash
export $(grep TRIPADVISOR_API_KEY .env | xargs)
```

### Error signatures

| Response | Meaning | Fix |
|---|---|---|
| `User is not authorized to access this resource with an explicit deny` | IP not on allowlist | Whitelist current IP at the developer portal, wait 1-5 min |
| `Forbidden` / 403 with no body | Bad or expired key | Regenerate key |
| `429 Too Many Requests` | Hit monthly quota (5,000 calls) | Wait until next month or upgrade tier |

## Endpoints

### 1. Location Search

Find locations by name. Returns up to 10 results.

```bash
curl -s "https://api.content.tripadvisor.com/api/v1/location/search?key=$TRIPADVISOR_API_KEY&searchQuery=NOFO+Hotel+Stockholm&category=hotels&language=en"
```

**Parameters:**

| Param | Required | Description |
|-------|----------|-------------|
| `searchQuery` | Yes | Text search query (name of hotel, restaurant, city) |
| `category` | No | Filter: `hotels`, `restaurants`, `attractions`, `geos` |
| `phone` | No | Phone number filter (any format, no leading +) |
| `address` | No | Address filter |
| `latLong` | No | Lat/long pair, e.g. `59.3127,18.0716` |
| `radius` | No | Radius from latLong (number) |
| `radiusUnit` | No | `km`, `mi`, or `m` |
| `language` | No | Default `en`. Supports 40+ languages. |

**Response shape:**

```json
{
  "data": [
    {
      "location_id": "237656",
      "name": "Nofo Hotel",
      "address_obj": {
        "street1": "Tjarhovsgatan 11",
        "city": "Stockholm",
        "country": "Sweden",
        "postalcode": "116 21",
        "address_string": "Tjarhovsgatan 11, Stockholm 116 21 Sweden"
      }
    }
  ]
}
```

### 2. Location Details

Get comprehensive info for a location by ID. This is the richest endpoint.

```bash
curl -s "https://api.content.tripadvisor.com/api/v1/location/{locationId}/details?key=$TRIPADVISOR_API_KEY&language=en&currency=USD"
```

**Parameters:**

| Param | Required | Description |
|-------|----------|-------------|
| `locationId` | Yes (path) | TripAdvisor location ID from search |
| `language` | No | Default `en` |
| `currency` | No | ISO 4217 code, default `USD` |

**Response includes:**

- `name`, `web_url`, `address_obj`, `latitude`, `longitude`, `timezone`, `phone`
- `rating` (string, e.g. "4.6"), `num_reviews` (string, e.g. "845")
- `review_rating_count`: breakdown by star (`{"1": "7", "2": "10", ...}`)
- `ranking_data`: `ranking` (#10), `ranking_out_of` (168), `ranking_string` ("#10 of 168 hotels in Stockholm")
- `subratings`: Location, Sleep Quality, Rooms, Service, Value, Cleanliness (each 0.0 to 5.0)
- `price_level`: "$", "$$", "$$$", "$$$$"
- `amenities`: array of strings
- `styles`: array (e.g. "Family", "Centrally Located")
- `neighborhood_info`: array with location_id and name
- `trip_types`: business, couples, solo, family, friends with count values
- `awards`: Travelers Choice, Best of Best, etc. with year and images
- `parent_brand`, `brand`: chain affiliation
- `category`, `subcategory`: hotel/restaurant/attraction
- `photo_count`, `see_all_photos` URL
- `write_review` URL

### 3. Location Reviews

Get up to 5 most recent reviews.

```bash
curl -s "https://api.content.tripadvisor.com/api/v1/location/{locationId}/reviews?key=$TRIPADVISOR_API_KEY&language=en"
```

**Parameters:**

| Param | Required | Description |
|-------|----------|-------------|
| `locationId` | Yes (path) | TripAdvisor location ID |
| `language` | No | Default `en` |
| `limit` | No | Number of results (max 5 on free tier) |
| `offset` | No | Index of first result |

**Response shape:**

```json
{
  "data": [
    {
      "id": 123456,
      "lang": "en",
      "location_id": "237656",
      "published_date": "2026-03-15T00:00:00-04:00",
      "rating": 5,
      "text": "Review text...",
      "title": "Review title",
      "trip_type": "Couples",
      "travel_date": "2026-03",
      "user": { "username": "traveler123" },
      "subratings": {}
    }
  

CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

none-observed

Shell

none-observed

Dependencies

pinned

Secrets in source

none-found

Findings (5)

.agents/skills

.claude/skills

.opencode/skills

skills

AGENTS.md

Gates applied: no_behavioural_pass.