API reference
Every company portal endpoint, with its parameters, response shape, and a runnable example.
Endpoints are grouped by resource in the sidebar. Every one requires a bearer token — if you have not made a call yet, start with the quickstart.
Each page shows its own base URL at the top, next to the method and path. Read it from there: MagicDoor is a set of services rather than one origin, and endpoints move between them as the original application is broken up.
These hold everywhere. The introduction explains each in full.
| Convention | Detail |
|---|---|
| Base URL | Per service, shown on every endpoint page — https://services.{domain}/leasing, https://api.portal.{domain}, https://auth.{domain} |
| Identifiers | 64-bit numbers sent as strings, e.g. "1830472847398404096". Never parse one as a number |
| Timestamps | 2026-08-17T21:04:11 — no offset, already in your company's timezone |
| Dates | 2026-03-01, no time and no zone, for things like lease start dates |
| Money | Decimal in the company's currency — 1850.00 is $1,850.00, not cents |
| Empty values | Omitted from the response entirely, never sent as null |
| Enumerations | camelCase strings such as "multiFamily", never numbers |
| Lists | Paged by page and pageSize — see Pagination |
| Errors | RFC 7807 problem details, identical across services — see Errors |
Most endpoints require a permission, named in the page's description as a resource:action string such as leases:read. An API key carries a subset of its owner's permissions; calling an endpoint the key does not cover returns 403. See Authentication for how to scope a key.
Every endpoint page carries a cURL sample with the real base URL and example values filled in. Set a token first and the sample runs as-is:
export MAGICDOOR_TOKEN=$(curl -s \
--url 'https://auth.magicdoor.com/api-keys/token' \
--header 'Content-Type: application/json' \
--data "{\"key\": \"$MAGICDOOR_API_KEY\"}" | jq -r .accessToken)There is no sandbox. Calls here act on real properties, real tenants, and real money. Read-only endpoints are safe to explore; be deliberate with anything that writes.