# REST API

Base URL: `https://{your-org}.doorops.com/api/v1`

See [authentication](/docs/developers/authentication) for keys. The live OpenAPI playground is at [/docs/api](/docs/api).

## Scopes

Tick only what the integration needs. Writes still pass Laravel policies.

- `customers:read` / `customers:write`
- `sites:read` / `sites:write`
- `jobs:read` / `jobs:write`
- `assets:read`
- `quotes:read`
- `invoices:read`
- `forms:read` / `forms:write`
- `fleet:read` / `fleet:write`
- `reports:read`
- `telephony:read` / `telephony:write`

## What you can call today

| Method | Path |
| --- | --- |
| GET | `/ping` |
| GET, POST | `/customers` |
| GET, PATCH | `/customers/{customer}` |
| GET, POST | `/sites` |
| GET, PATCH | `/sites/{site}` |
| GET, POST | `/sites/{site}/contacts` |
| GET | `/jobs` |
| GET | `/jobs/{job}` |
| PATCH | `/jobs/{job}/status` |
| GET | `/assets`, `/assets/{asset}` |
| GET | `/quotes`, `/quotes/{quote}` |
| GET | `/invoices`, `/invoices/{invoice}` |
| GET | `/reporting/snapshot`, `/reporting/jobs` |
| GET, POST | `/telephony/calls` |
| GET | `/telephony/calls/{call}` |
| GET | `/fleet/vehicles` |
| POST | `/fleet/vehicle-locations` |

Hosted OpenAPI UI (try-it, needs a session): [doorops.com/docs/api](https://doorops.com/docs/api)

## Conventions

- JSON in and out
- Tenant isolation is the host, not a header you can spoof
- Unknown cross-tenant ids return not found, not a leak
- Pagination is server-side on list endpoints