query (required, e.g. kol or Delhi), optional session_token (pass null/omit on the FIRST keystroke of a fresh search - the server mints one and returns it in data.session_token; echo that same value back on every following keystroke's call here AND on the final GET /public/places/details call, so Google bills the whole typing session once instead of per-request).place_id+name candidates - true prefix matching (kol matches Kolkata), unlike a full-address geocode. The app never needs its own Google Maps key. This endpoint deliberately does NOT return coordinates or timezone - call GET /public/places/details with the chosen result's place_id once the user picks one, to resolve those.session_token, so a popular prefix isn't re-billed to Google on every search across every user regardless of whose session asked for it.200 - data.results[] (up to 5 candidates, each with place_id/name) plus data.session_token (always present, carry it forward); [] results when nothing matches or the lookup failed - never a 4xx for a genuinely empty result.422 - missing/blank query. 429 - too many searches from this IP (>20 per 60s) - this endpoint is unauthenticated and calls a billed Google API, so it carries its own tighter limit on top of the app-wide one.