Skip to main content
Use the Partner API when an external system needs authenticated, workspace-scoped server-to-server access to RoofKit. CRMs, forms, schedulers, and agencies use it to sync leads, read attribution, order roof reports, and create roof renders. AI clients that act for a signed-in workspace member use RoofKit MCP instead. MCP uses OAuth, not API keys.

​
Base URL and authentication

Every endpoint is under https://api.roofkit.ai/api/v1. Send a workspace API key as a Bearer token on each request.
Verify the API key
Verify API key returns the key and the workspace that it belongs to.

API keys

Create and manage keys in workspace settings. Keep keys on your server and rotate them when ownership changes.

OpenAPI document

Download the OpenAPI 3.1 contract that this reference is built from.

​
Contract

RoofKit Partner API v1 authenticates requests with workspace API keys. API keys bind each request to exactly one workspace; Partner API paths do not accept roofer_id, workspace_id, or tenant identifiers. Authenticated endpoints are limited to 60 requests per minute per API key, method, and route template; invalid authentication attempts are limited separately at 20 requests per minute per client and endpoint. Date-time parameters and fields accept ISO 8601 with Z or a ±HH:MM offset, for example 2026-09-07T04:00:00Z or 2026-09-07T00:00:00-04:00. Both name the same instant and return the same result. Encode + as %2B in a query string. Responses return UTC. A date-time without an offset, for example 2026-09-07T04:00:00, is deprecated. Until the sunset on 2027-01-10T00:00:00Z it is read as UTC, and the response carries a Deprecation header (RFC 9745) and a Sunset header (RFC 8594). From the sunset, Z or a ±HH:MM offset is required. A date-time without an offset then returns 400 with the VALIDATION_ERROR code, and the response carries no Deprecation or Sunset header. Each API key holds only the scopes that a workspace owner or admin chose when the key was created, and its scopes never change. Each operation lists the scopes it requires in x-required-scopes. A new key in Settings starts on the Read-only preset: leads.read, analytics.read, reports.read, and data_objects.read. A Read-only key can call every read operation except exports, Sales Visualizer reads, and trashed Data Objects, and it cannot call any write operation. A call that needs a scope the key does not hold returns 403 FORBIDDEN, and error.details.required_scope names a missing scope.

​
Errors

Every error returns the same body. code is stable. Use request_id when you contact support.
Error body
details is optional. Each endpoint page lists the statuses that it returns.

​
Pagination

Cursor-paged list endpoints take limit and cursor, and return a pagination object with limit, next_cursor, and has_more. Send next_cursor as cursor to read the next page. Stop when has_more is false. Each endpoint page shows its own limits.

​
Try it out

Each endpoint page has a playground. It sends the request from your browser straight to api.roofkit.ai, so your API key does not pass through the docs host.
Requests change real dataThe playground calls the live API with your key. Write endpoints create, update, and bill in your workspace. Use a key from a test workspace when you try write endpoints.