Public API
Integrate RepOtz with your own systems (POS, CRM, e-commerce, Zapier, Make) via a documented REST API. Integration scopes are available from the Pro plan; three exploitation scopes remain reserved for the Max plan.
API Tokens
Section titled “API Tokens”From your Account (Account > API Tokens), you create API tokens per account, each limited to scopes, one per resource:
Integration scopes (Pro and Max plans)
read:account- your plan, your limits and their consumption.read:businesses- your businesses, locations and configuration status.write:contacts- your contacts: read, create, modify, CSV import. This is the entry point for a POS or CRM integration (a customer just paid > a contact > an invitation). Creating a contact requires automation of review requests (Pro). A contact can have alocale(fr,enores): they will then receive their invitations in that language, before the campaign language.campaigns:manage- your campaigns and their funnels.invitations:trigger- trigger sending of an invitation campaign.read:feedbacks- the private feedbacks collected by your funnels, with the contact details left by the customer.read:reviews- your latest Google reviews.write:links- the platforms on your link page: activation, address, order, display rules, and link monitoring status.read:qr- your QR codes (scans, statistics) and your short links (clicks).manage:webhooks- your outgoing webhooks: subscription, log, replay, secret rotation.
Exploitation scopes (Max plan)
analytics:read- click analytics for the account.read:testimonials- your video testimonials, with a signed download address valid for one hour.write:audits- launch a prospect reputation audit and read its result.
The token is displayed only once at creation (keep it safe). You can rotate it or revoke it at any time.
Available surface
Section titled “Available surface”Each scope opens the routes for its resource, all limited to your account: a resource that does not belong to you returns 404. The complete list, with parameters and responses, is in the OpenAPI documentation (https://api.repotz.com/api/v2/public/openapi.json).
Two limits apply per token: 60 requests per minute, and a daily quota depending on the plan (5,000 calls on Pro, 20,000 on Max). Beyond that, the response is HTTP 429 with the Retry-After header.
Outgoing webhooks
Section titled “Outgoing webhooks”A webhook notifies your system (CRM, Slack via Zapier or Make, your own server) the instant something happens in RepOtz, without it having to query the API. Available from the Pro plan, from Dashboard > Integrations or via the API (manage:webhooks).
Events: feedback.submitted (new feedback), feedback.low_rating (rating of 2 or less), testimonial.uploaded (video testimonial received), contact.created (new contact, regardless of source), invitation.sent (invitation sent to a contact), platform_link.broken (a link on your page confirmed offline).
What your server receives: a POST request in JSON { id, event, occurred_at, account_id, data } with headers X-Repotz-Event, X-Repotz-Event-Version: 1, X-Repotz-Delivery and a signature X-Repotz-Signature: t=<timestamp>,v1=<fingerprint>. The fingerprint is an HMAC-SHA256 of <timestamp>.<body> calculated with the secret displayed only once at webhook creation; verify it before processing the message, and reject a timestamp older than five minutes. After secret rotation, the old one remains valid for 24 hours and the header carries two fingerprints.
Delivery: your server must respond 2xx within 10 seconds. Otherwise, RepOtz retries after 1 min, 5 min, 30 min, 2 h then 12 h; after five attempts delivery is marked as failed. After 20 consecutive failed deliveries, the webhook is disabled and you receive an email; fix it, then reactivate it. The log of the last 30 days, with each response received, can be viewed in Integrations, and any delivery can be replayed (same event ID, for deduplication). A Send a ping button verifies your setup at any time. A maximum of ten webhooks per account.
Zapier and Make
Section titled “Zapier and Make”The RepOtz for Zapier and RepOtz for Make applications are built on this API and these webhooks: instant triggers (new feedback, low rating, testimonial, new contact, invitation sent, broken link), actions (create a contact, send an invitation campaign) and searches. They connect with an API token carrying the useful scopes (manage:webhooks for triggers, write:contacts and invitations:trigger for actions, read:account to test the connection). Ready-made recipes: Slack (alert on each low rating), Google Sheets (one row per feedback or contact), HubSpot (contacts both ways). Details by tool are at https://repotz.com/integrations.
Frequently asked questions
Section titled “Frequently asked questions”Q. On which plan is the public API available? A. Integration scopes from the Pro plan; analytics, testimonials and audits scopes require the Max plan. A Pro token requesting an Max scope is rejected by naming the scope. The Basic plan has no token.
Q. I lost my token, can I see it again? A. No, it is only displayed at creation. Create a new one (or rotate it) and revoke the old one.
Q. Can I receive webhooks for each new review?
A. Yes, from the Pro plan: subscribe a webhook to feedback.submitted (and feedback.low_rating to be alerted of low ratings). Google reviews themselves will arrive with review persistence (google_review.*).