Lavisho TT API v1

Every request needs a company API key, created under Settings → API & Webhooks. Keys are shown once at creation, stored only as hashes, and can be scoped read-only or read/write, set to expire, and revoked at any time.

curl https://lavishott.cloud/api/public/v1/leads \
  -H "x-api-key: ltt_xxxxxxxx_xxxxxxxxxxxxxxxx"

API access is available on the Enterprise plan. Keys are not user-delegated OAuth tokens; when a company enables strict field-level security, API reads of field-protected objects are disabled until per-user key delegation ships.

Versioned under /api/public/v1/: leads (alias opportunities), customers, contacts, quotes, products (alias items), tasks, plus read-only lookups for owners, stages, sources, accounts, oems and task-statuses. A public health check lives at /api/public/v1/health.

All resources are scoped to the company that owns the key. Unknown fields are rejected; request bodies are limited to 64 KiB.

List endpoints accept limit (1–200, default 50), offset, search, order (asc/desc) and resource-specific filters such as stage, assigned_to and lead_id. Responses include a pagination object with limit, offset and total.

GET /api/public/v1/leads?stage=negotiation&limit=50&offset=0&order=desc

POST, PATCH and DELETE accept an Idempotency-Key header (8–128 safe ASCII characters). Retrying with the same key and body returns the original result; the same key with a different body returns 409. Currency defaults to the company base currency.

curl -X POST https://lavishott.cloud/api/public/v1/leads \
  -H "x-api-key: ltt_..." -H "Content-Type: application/json" \
  -H "Idempotency-Key: onboarding-run-2026-10-26-lead-42" \
  -d '{"customer_name":"Padma Trading Co","stage":"new"}'

Errors are JSON {"error": "..."} with status codes: 400 malformed, 401 key problem, 403 scope or plan restriction, 404 not found, 409 duplicate/idempotency conflict, 413 body too large, 422 invalid fields, 429 rate limited, 503 temporarily unavailable.

Each key is limited to 120 requests per UTC minute. Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; when limited, respect Retry-After.

Register endpoints under Settings → API & Webhooks and subscribe to events such as lead.created, lead.updated and lead.stage_changed. Deliveries are signed with HMAC-SHA256 over timestamp.body using your endpoint secret:

// Verify (Node.js)
const expected = createHmac('sha256', secret)
  .update(`${header('x-webhook-timestamp')}.${rawBody}`)
  .digest('hex')
timingSafeEqual(Buffer.from(header('x-webhook-signature')), Buffer.from(expected))

Failed deliveries retry with backoff (1, 5, 15, 60 and 360 minutes, up to 5 attempts) and are visible in the delivery log, where admins can replay a delivery or send a signed test event.

// JavaScript
const res = await fetch('https://lavishott.cloud/api/public/v1/customers?limit=100', {
  headers: { 'x-api-key': process.env.LTT_API_KEY },
})
const { data, pagination } = await res.json()

# Python
import os, requests
r = requests.get('https://lavishott.cloud/api/public/v1/quotes',
  headers={'x-api-key': os.environ['LTT_API_KEY']}, params={'limit': 100})
r.raise_for_status()
rows = r.json()['data']