This is kind of a hard one to give a clue for. You should be able to list all of the cities without gobuster, the module mentions this:
curl -s http://<SERVER_IP>:<PORT>/api.php/city/ | jq
If you add a city named flag, then use that command you should see it listed.
For a slightly bigger push, almost a solution really, give this thread a read, he had similar issues: