API reference

The complete endpoint list, generated from the same registry that builds the OpenAPI document — so it cannot describe an endpoint that does not exist, or miss one that does.

The machine-readable spec is at /developers/openapi.json.

Meta

GET /ping — Echoes back which workspace and scopes your credential resolves to. The first call every integration should make.

Contacts

DELETE /contacts/{id} — ANONYMIZES in place — it does not delete the row. A contact is referenced by deals, commissions and messages a brokerage is required to keep, so a true delete would either cascade those away or leave them dangling. Names, addresses, message bodies and activity titles are scrubbed; the structural records survive pointing at an anonymized contact.

POST /contacts/{id}/notes — Adding a note pauses the contact's AI auto-response, exactly as it does in the product — a human (or an integration) touching a conversation is the signal that the AI should stop talking over them.

Leads

POST /leads — Creates the lead and routes it through the assignment engine unless skip_routing is set. A lead created WITHOUT a consent object carries no consent artifact, so the pre-dial and pre-send gates will refuse AI outbound to it — the response says so in ai_outbound_allowed.

POST /leads/routing-preview — A dry run: creates nothing, assigns nothing, notifies nobody. Returns the rule that would win, the assignee, and the full considered set with the failing conditions spelled out. For round-robin methods the rotation cursor is NOT advanced, so the live pick may be a different member of the same pool — reason says so.

Messaging

POST /messages — Routes through the same send path the product uses, so every compliance check applies: suppression, opt-out, A2P registration, TCPA quiet hours and consent. A refused send returns 422 compliance_blocked with the reason — never a silent success — and the attempt is still recorded in the workspace's inbox.

Calls

GET /calls — Includes AI-handled calls with their summaries. handled_by distinguishes AI from human.

GET /calls/{id} — recording_url is a five-minute signed link to our own proxy, never the carrier's URL (which is credential-protected and would 401 for you).

Deals

Listings

GET /listings — These are listings the workspace authored, NOT MLS inventory. MLS data is governed by per-board display rules that a general-purpose REST feed cannot honour.

Calendar

POST /appointments — Pushes the event out to the creator's connected calendar when one exists, exactly as an in-product booking does.

PATCH /appointments/{id} — Send starts_at AND ends_at together to move it; send outcome to record what happened. Both are separate domain writes, and moving with only one end is refused.

POST /tasks — Deduped within 60 seconds, so a retried webhook does not produce two identical follow-ups. created: false means an identical task already existed.

Automations

POST /automations/{id}/enroll — Returns 202: the enrolment is durable immediately, and the automation runs on the next engine tick. Enrolling into a disabled automation is refused rather than silently dropped.

Webhooks

POST /webhooks — The signing secret is returned exactly once, here. Every delivery carries X-Webhook-Signature: sha256=<hmac> over the exact request body.