API Documentation

Getting Started

Every Rentari.ai API request talks to https://www.rentari.ai/api/v1/external over HTTPS, sends and receives JSON, and is scoped to a single landlord portfolio. Three steps to make your first call:

1. 1

   Generate an API key

   Open the Developer dashboard, submit a short access request, and once approved click "Create key". Test keys start with sk_test_, live keys with sk_live_. Store the key in your secret manager. We never show it again.

2. 2

   Send the bearer header

   Add Authorization: Bearer <your_key> to every request. Missing or malformed headers return HTTP 401.

3. 3

   Make a test call

   Hit GET /api/v1/external/properties with a test key. It returns the demo portfolio, so you can integrate before any real data exists.

Authentication

The Rentari.ai API uses API keys to authenticate requests. You can view and manage your API keys in the Landlord Settings Dashboard. Your API keys carry many privileges, so be sure to keep them secure!

curl https://www.rentari.ai/api/v1/external/properties \
  -H "Authorization: Bearer sk_live_your_api_key_here"

import requests

requests.get(
    "https://www.rentari.ai/api/v1/external/properties",
    headers={"Authorization": f"Bearer {api_key}"},
)

const axios = require("axios");

axios.get("https://www.rentari.ai/api/v1/external/properties", {
  headers: { Authorization: `Bearer ${apiKey}` },
});

await fetch("https://www.rentari.ai/api/v1/external/properties", {
  headers: { Authorization: `Bearer ${apiKey}` },
});

Webhooks

Subscribe to real-time events to keep your internal CRM or accounting software perfectly synced with Rentari.ai. Endpoints must be HTTPS and return a 200 status code quickly.

Webhook Signing

Every webhook delivery includes an X-Rentari.ai-Signature header. Verify it before trusting the payload. The signature is the hex HMAC-SHA256 of timestamp.body using your endpoint signing secret (shown once when you create the endpoint). Reject requests older than 5 minutes to defeat replay attacks.

import hmac, hashlib, time

def verify(secret, raw_body, header):
    ts, sig = header.split(",")
    ts = ts.split("=")[1]
    sig = sig.split("=")[1]
    if abs(time.time() - int(ts)) > 300:
        raise ValueError("stale webhook")
    expected = hmac.new(
        secret.encode(), f"{ts}.{raw_body}".encode(), hashlib.sha256
    ).hexdigest()
    if not hmac.compare_digest(expected, sig):
        raise ValueError("bad signature")

const crypto = require("crypto");

function verify(secret, rawBody, header) {
  const [tsPart, sigPart] = header.split(",");
  const ts = tsPart.split("=")[1];
  const sig = sigPart.split("=")[1];
  if (Math.abs(Date.now() / 1000 - Number(ts)) > 300) {
    throw new Error("stale webhook");
  }
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${rawBody}`)
    .digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(sig))) {
    throw new Error("bad signature");
  }
}

Rentari.ai retries failed deliveries with exponential backoff for 24 hours. Return any 2xx to acknowledge.

Errors

Rentari.ai uses standard HTTP status codes. All error responses share the same envelope so you can write one handler:

{
  "error": {
    "type": "validation_error",
    "code": "invalid_field",
    "message": "monthly_rent must be a positive number.",
    "param": "monthly_rent",
    "request_id": "req_8x9a2b1c"
  }
}

Always log request_id. Our support team can find any request by id within 90 days.

Rate Limits

Limits are per API key, measured over a rolling 60-second window. Every response includes the headers below so you can implement adaptive backoff:

X-RateLimit-Limit: 600
X-RateLimit-Remaining: 412
X-RateLimit-Reset: 1717689600
Retry-After: 14

Pagination

All list endpoints use cursor pagination. Pass limit (default 20, max 100) and the starting_after id from the previous page. The response always includes has_more so loops can terminate cleanly.

GET /api/v1/external/properties?limit=20&starting_after=prop_8x9a2

{
  "object": "list",
  "data": [ /* up to 20 items */ ],
  "has_more": true,
  "next_cursor": "prop_q4z1m"
}

Cursors are opaque, do not parse them. They are stable across writes, so polling is safe.

Endpoint Reference

The full surface available today. Every list endpoint follows the pagination contract above; every mutation respects idempotency keys via the Idempotency-Key header.

Need an endpoint that isn't here yet? Email [email protected] with the use case.

Connect Your Own AI (MCP)

Rentari runs a Model Context Protocol server, so you can point Claude, Cursor, ChatGPT, or any MCP-capable assistant at your own portfolio. The assistant reads your data and, if you allow it, makes changes. It uses the same API key and the same permissions as the REST API above.

Setting it up

1. Open your developer dashboard and create an API key.
2. Pick what the key is allowed to do. Read only is the safe default for an assistant.
3. Copy the key. It is shown once.
4. Add the server to your assistant. In Cursor, that means a .cursor/mcp.json entry:

{
  "mcpServers": {
    "rentari": {
      "url": "https://www.rentari.ai/mcp",
      "headers": {
        "Authorization": "Bearer sk_live_YOUR_KEY_HERE"
      }
    }
  }
}

Permissions

Every key carries scopes, and the assistant can never exceed them. Choose the narrowest scope that does the job.

Test (sandbox) keys are always read only, no matter which scopes they carry. Revoking a key in the dashboard cuts the assistant off immediately.

Available tools

Preview before changing

Every write tool accepts dry_run. With dry_run: true the server validates the change and returns exactly what the record would look like, without saving. The server instructs connected assistants to preview first and ask you before committing, so you see the change described in plain language before it happens.

{
  "name": "update_maintenance_ticket",
  "arguments": {
    "ticket_id": "abc123",
    "status": "completed",
    "dry_run": true
  }
}

Limits

MCP calls count against the same per-key rate limits as the REST API, and responses carry the same X-RateLimit-* headers. A single request may carry a batch of up to 20 messages, and each message in the batch counts separately. Assistants tend to be chattier than hand-written integrations, so watch the remaining-call header if you are on the free tier.