API Documentation

Getting Started

Every Rentari.ai API request talks to https://Rentari.ai/api/v1/external over HTTPS, sends and receives JSON, and is scoped to a single landlord portfolio. Three steps to make your first call:

1. 1

   Generate an API key

   Open the Developer dashboard, submit a short access request, and once approved click "Create key". Test keys start with sk_test_, live keys with sk_live_. Store the key in your secret manager. We never show it again.

2. 2

   Send the bearer header

   Add Authorization: Bearer <your_key> to every request. Missing or malformed headers return HTTP 401.

3. 3

   Make a test call

   Hit GET /api/v1/external/properties with a test key. It returns the demo portfolio, so you can integrate before any real data exists.

Authentication

The Rentari.ai API uses API keys to authenticate requests. You can view and manage your API keys in the Landlord Settings Dashboard. Your API keys carry many privileges, so be sure to keep them secure!

curl https://Rentari.ai/api/v1/external/properties \
  -H "Authorization: Bearer sk_live_your_api_key_here"

import requests

requests.get(
    "https://Rentari.ai/api/v1/external/properties",
    headers={"Authorization": f"Bearer {api_key}"},
)

const axios = require("axios");

axios.get("https://Rentari.ai/api/v1/external/properties", {
  headers: { Authorization: `Bearer ${apiKey}` },
});

await fetch("https://Rentari.ai/api/v1/external/properties", {
  headers: { Authorization: `Bearer ${apiKey}` },
});

Webhooks

Subscribe to real-time events to keep your internal CRM or accounting software perfectly synced with Rentari.ai. Endpoints must be HTTPS and return a 200 status code quickly.

Webhook Signing

Every webhook delivery includes an X-Rentari.ai-Signature header. Verify it before trusting the payload. The signature is the hex HMAC-SHA256 of timestamp.body using your endpoint signing secret (shown once when you create the endpoint). Reject requests older than 5 minutes to defeat replay attacks.

import hmac, hashlib, time

def verify(secret, raw_body, header):
    ts, sig = header.split(",")
    ts = ts.split("=")[1]
    sig = sig.split("=")[1]
    if abs(time.time() - int(ts)) > 300:
        raise ValueError("stale webhook")
    expected = hmac.new(
        secret.encode(), f"{ts}.{raw_body}".encode(), hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise ValueError("bad signature")

const crypto = require("crypto");

function verify(secret, rawBody, header) {
  const [tsPart, sigPart] = header.split(",");
  const ts = tsPart.split("=")[1];
  const sig = sigPart.split("=")[1];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    throw new Error("stale webhook");
  }
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
    throw new Error("bad signature");
  }
}

Rentari.ai retries failed deliveries with exponential backoff for 24 hours. Return any 2xx to acknowledge.

Errors

Rentari.ai uses standard HTTP status codes. All error responses share the same envelope so you can write one handler:

{
  "error": {
    "type": "validation_error",
    "code": "invalid_field",
    "message": "monthly_rent must be a positive number.",
    "param": "monthly_rent",
    "request_id": "req_8x9a2b1c"
  }
}

Always log request_id. Our support team can find any request by id within 90 days.

Rate Limits

Limits are per API key, measured over a rolling 60-second window. Every response includes the headers below so you can implement adaptive backoff:

X-RateLimit-Limit: 600
X-RateLimit-Remaining: 412
X-RateLimit-Reset: 1717689600
Retry-After: 14

Pagination

All list endpoints use cursor pagination. Pass limit (default 20, max 100) and the starting_after id from the previous page. The response always includes has_more so loops can terminate cleanly.

GET /api/v1/external/properties?limit=20&starting_after=prop_8x9a2

{
  "object": "list",
  "data": [ /* up to 20 items */ ],
  "has_more": true,
  "next_cursor": "prop_q4z1m"
}

Cursors are opaque, do not parse them. They are stable across writes, so polling is safe.

Endpoint Reference

The full surface available today. Every list endpoint follows the pagination contract above; every mutation respects idempotency keys via the Idempotency-Key header.

Need an endpoint that isn't here yet? Email api@rentari.ai with the use case.