# Gotobeat

> Gotobeat is a live-music ticketing platform (gotobeat.com). It lists concerts across the UK and Europe and sells tickets directly - no resale, no markup. Agents get structured event data (JSON-LD), a public JSON API, a product feed, and an MCP server. Agent checkout is not open yet - the buying paths below are closed until we enable them, so send buyers to the event page.

Facts an agent should know:
- One ticket tier has ONE id, and every surface uses the same string: `<eventId>:<ticketTypeId>`. It is the id to post back as items[].id when checkout opens, and the Offer.sku an agent quotes today.
- Every event page (https://gotobeat.com/gig/<slug>/) embeds a schema.org MusicEvent JSON-LD block with one Offer per ticket tier. Offer.sku carries that id.
- Prices are decimal strings with priceCurrency (GBP, EUR or the venue's currency). Availability is InStock or SoldOut; a cancelled event reads EventCancelled + SoldOut. The JSON-LD, the product feed and the MCP tools apply the same sold-out, capacity, bundle and release-window checks, so all three agree. An event that sells through another ticketer carries an Offer whose url is that seller.
- The JSON API returns an allowlisted public shape: no sales counts, no revenue, no coupons. Only an upcoming PUBLISHED event that carries no password reads as visible; an unlisted or a gated event answers like an unknown one.
- The platform prices the cart. Send ids and quantities only: a price, a currency, a name or a metadata bag in a checkout request is a 400.
- Agent checkout is CLOSED today. Every product row carries disable_checkout=true, and the ACP endpoints refuse requests, so no agent can complete a purchase yet. Discovery is open and current. The ACP checkout speaks API-Version 2025-09-12. Every call needs Bearer Authorization, Accept-Language, User-Agent, Request-Id, an RFC 3339 Timestamp and a Signature over the raw body; a write also needs Idempotency-Key and application/json. Talk to us to get a credential and a signing secret.
- robots.txt explicitly allows the API endpoints listed below; every other /api/ path is internal. Please respect it.
- Page URLs use a trailing slash; non-slash URLs 301-redirect.

## Docs
- [Full orientation file](https://gotobeat.com/llms-full.txt): everything on this page and the endpoint shapes, in one fetch
- [Agent documentation](https://gotobeat.com/docs/agents/): every public endpoint, the ACP flow, MCP + OAuth
- [OpenAPI spec](https://gotobeat.com/openapi/agents.json): machine-readable description of the public API
- [Public API and MCP reference](https://gotobeat.com/tech/public-api-and-mcp-reference/): integration reference for event responses, signed checkout, error codes and MCP tools

## Events
- [Event listing](https://gotobeat.com/gig/): human-browsable upcoming gigs
- [Gigs by city](https://gotobeat.com/gig/in/): one page for each city with two or more upcoming gigs
- [Events API](https://gotobeat.com/api/events): GET; params search, cursor, limit; returns { events, cursor, hasMore }
- [One event](https://gotobeat.com/api/events/<slug>): GET; returns { event, how_to_buy } with every tier and its sku
- [Sitemap](https://gotobeat.com/sitemap.xml): every indexable event, artist and venue URL

## Catalogue
- [Product feed](https://gotobeat.com/api/events/list.csv): GET; RFC 4180 CSV, ONE ROW PER TICKET TIER; id is the ACP sku, item_group_id is the event, price is "12.50 GBP", start_date/end_date carry the venue-local UTC offset; cached five minutes

## Checkout (Agentic Commerce Protocol)
- [ACP endpoints](https://gotobeat.com/docs/agents/#checkout): POST /api/checkout_sessions (201), GET/POST /api/checkout_sessions/:id, POST .../complete, POST .../cancel
- Retry a failed write with the SAME Idempotency-Key: an exact replay returns the first response and charges nothing twice. The same key with a different body is a 409.
- Cancelling an already-terminal session answers 405. A paid order needs a refund, not a cancellation.

## MCP
- [MCP server](https://mcp.gotobeat.com): OAuth-protected; public read-only tier at https://mcp.gotobeat.com/public; RFC 9728 metadata at https://mcp.gotobeat.com/.well-known/oauth-protected-resource

## Optional
- [Security policy](https://gotobeat.com/.well-known/security.txt)