---
title: "Quote without handling PII: traveler enters details on a secure page"
method: POST
path: "/api/v1/quotes/secure"
tags: ["Quote"]
---

# Quote without handling PII: traveler enters details on a secure page

`POST /api/v1/quotes/secure`

## Request

- Base URL: `https://www.upgradeagent.ai`
- URL: `https://www.upgradeagent.ai/api/v1/quotes/secure`
- Auth: one of:
  - OAuth 2 (authorization code, authorization URL `https://www.upgradeagent.ai/api/oauth/authorize`, token URL `https://www.upgradeagent.ai/api/oauth/token`, scopes: `mcp`)
  - HTTP bearer

The MCP `start_eligibility_check` equivalent. Returns a secure URL for the traveler; poll `GET /api/v1/quotes/{quoteId}` until the status is no longer PENDING.

## Request body

- SecureQuoteRequest
  - `carrier` string: Operator IATA code or name, if known.
  - `language` string: ISO 639-1 (default en).

## Response `201`

Pending quote with the traveler's secure link.

- SecureQuote
  - `quoteId` string, required
  - `status` 'PENDING', required
  - `carrier` string, nullable, required
  - `secureUrl` string, required: Share with the traveler exactly as-is.
  - `expiresAt` string, required
  - `message` string, required

## Other responses

- `401`: Missing, invalid, expired, or revoked bearer token. The WWW-Authenticate challenge points at the OAuth protected-resource metadata.
- `429`: Per-caller rate limit exceeded.
- `503`: Quote store unavailable; retry.

---

[API](https://skmtc.dev/upgradeagent/apis/upgrade-agent-rest-api.md) · [All operations](https://skmtc.dev/upgradeagent/apis/upgrade-agent-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/upgradeagent/apis/upgrade-agent-rest-api/revisions/fbed715712c1?raw)