Public API & webhooks

Connect your tools and apps to ReviewJalpi via API keys and webhooks—integrate with Zapier, Make, or custom applications for seamless data flow.

Getting your API key

1. Go to Settings → API keys.
2. Click Create API key, give it a name (e.g., "Zapier"), and select which data scopes you need:
   • reviews:read / reviews:write — manage reviews
   • customers:read / customers:write — manage customer records
   • inbox:read / inbox:write — read/send inbox messages
   • surveys:read — view survey responses
   • webhooks:manage — create and edit webhooks
3. Copy the key (rj_live_...). It's shown only once. Store it securely in your Zapier/Make account or app's auth settings.
4. Use it as a Bearer token: Authorization: Bearer rj_live_...

If you forget the key, revoke it from the settings page (it stops working within ~60 seconds) and create a new one.

Explore the full API

Browse all available endpoints at /api/docs—a live Swagger interface showing every REST call you can make (create customers, update reviews, list locations, etc.). Use the API key from step 3 to test requests right there.

Setting up webhooks

Webhooks let ReviewJalpi push events to your app instantly—perfect for Zapier catch hooks, Make custom webhooks, or your own integrations.

1. Go to Settings → Webhooks.
2. Click Create webhook and paste your target URL (must be https://, publicly accessible).
3. Select which events to subscribe to:
   • review.created — new review arrives
   • review.replied — you reply to a review
   • conversation.message_received — new inbox message
   • survey.response_received — customer answers a survey
   • listing.drifted — your business info changed on a directory
4. Copy the signing secret. It's shown only once.

Every event posts to your URL as JSON with two security headers:

• X-RJ-Signature: sha256=<hex>
• X-RJ-Timestamp: <unix seconds>

To verify: compute HMAC-SHA256(secret, timestamp + "." + raw_body) and compare the result (in hex) to the signature. Reject if the timestamp is older than 5 minutes. (Zapier and Make handle this automatically if you use their code steps.)

Zapier & Make integration

Create a Zap or Scenario using your API key to authenticate. Use the Catch Hook or Custom Webhook trigger with a webhook subscription here, then add actions from the /api/docs endpoints—all five event types and full REST API are available.

Managing keys and webhooks

• Disable a webhook to pause events without deleting it; toggle back to resume.
• View delivery logs by clicking a webhook—see which events succeeded or failed.
• Replay a failed delivery to retry manually (it doesn't count toward the auto-disable threshold).
• Revoke an API key to immediately block all apps using it.

Webhooks auto-disable after too many consecutive failures; check your endpoint logs and re-enable once it's healthy.