VerticalRent API

Programmatic access to listings, rental applications, and screening reports. Build integrations, automate workflows, or power custom internal tools — all authenticated with an API key.

Authentication

Every /api/v1 request must include Authorization: Bearer vr_pk_…. Create a key in Settings → API & Integrations. Keys start with vr_pk_ followed by 48 hex chars.

curl https://www.verticalrent.com/api/v1/listings \
  -H "Authorization: Bearer vr_pk_a1b2c3d4e5f6..."

Rotating keys

1. Create a new key in Settings → API Keys
2. Update your integration to use the new key
3. Verify everything still works, then revoke the old key

Security best practices

• Never commit keys to source control — use environment variables
• Use a separate key for each integration so one revocation doesn't break others
• Rotate keys at least quarterly
• Revoke immediately if you suspect a leak

Response Format

Success

{
  "ok": true,
  "data": { /* ... */ }
}

Paginated

{
  "ok": true,
  "data": [ /* ... */ ],
  "pagination": {
    "page": 1,
    "perPage": 25,
    "total": 142,
    "hasMore": true
  }
}

Error

{
  "error": "Invalid API key",
  "code": "INVALID_API_KEY"
}

Error codes

Endpoint Reference

Full request/response schemas are generated from our OpenAPI spec — always in sync with production.

Subscribe to real-time event notifications. We POST a JSON payload to your URL whenever a subscribed event fires, signed with HMAC-SHA256 so you can verify authenticity.

Create + manage subscriptions in Settings → API & Integrations (Webhooks).

Verifying the signature

Each delivery includes an X-VerticalRent-Signatureheader. Verify it by computing the same HMAC-SHA256 over the raw request body using your subscription's secret.

import crypto from "node:crypto";

export default function handler(req, res) {
  const sig = req.headers["x-verticalrent-signature"]; // "sha256=..."
  const body = req.rawBody; // raw request body string
  const expected = "sha256=" + crypto
    .createHmac("sha256", process.env.VR_WEBHOOK_SECRET)
    .update(body)
    .digest("hex");
  if (sig !== expected) return res.status(401).end();

  const event = JSON.parse(body);
  console.log("Received:", event.event, event.data);
  res.status(200).end();
}

Event types

Retry policy

Deliveries that fail (non-2xx response or network error) are retried automatically on this schedule: 1 min, 5 min, 30 min, 2 hours, 12 hours. After 5 attempts, the delivery is marked failed permanently. You can manually replay any delivery from Settings → Webhooks.

Quick-start Tutorials

Common integration patterns to get you started fast.