API and webhooks
Photo requests can also be created, activated and followed from your own tools, with the same rules as the web interface.
The API
- Versioned public API, described by an OpenAPI 3.1 specification.
- API keys specific to each workspace, with three levels: read only, write, and owner write, the only level that can commit credits.
- A key's secret is shown only once; it is sent in the Authorization header, never in a URL.
- Write requests are idempotent: replaying a request with the same idempotency key never creates anything twice.
- Limit of 600 requests per minute per key (fixed window).
Webhooks
- Events sent to the https addresses of your choice: request activated, cancelled or past due, photos submitted, retake submitted or past due.
- Each message is signed (HMAC-SHA256) and carries an event identifier so you can discard duplicates.
- On failure, up to 9 spaced-out attempts; an endpoint failing for 72 hours is disabled.
- The signing secret is shown only once and can be rotated with a 24-hour overlap.
Access
API keys and webhooks are managed by the workspace owner, from the web interface.