# API reference

Source: https://api-docs.magicdoor.com/api-reference/introduction

Every company portal endpoint, with its parameters, response shape, and a runnable example.

Endpoints are grouped by resource in the sidebar. Every one requires a bearer token — if you have not made a call yet, start with the [quickstart](https://api-docs.magicdoor.com/quickstart.md).

**Each page shows its own base URL** at the top, next to the method and path. Read it from there: MagicDoor is a set of services rather than one origin, and endpoints move between them as the original application is broken up.

## Conventions

These hold everywhere. [The introduction](https://api-docs.magicdoor.com/introduction.md) explains each in full.

| Convention | Detail |
| --- | --- |
| Base URL | Per service, shown on every endpoint page — `https://services.{domain}/leasing`, `https://api.portal.{domain}`, `https://auth.{domain}` |
| Identifiers | 64-bit numbers sent as **strings**, e.g. `"1830472847398404096"`. Never parse one as a number |
| Timestamps | `2026-08-17T21:04:11` — **no offset**, already in your company's timezone |
| Dates | `2026-03-01`, no time and no zone, for things like lease start dates |
| Money | Decimal in the company's currency — `1850.00` is $1,850.00, not cents |
| Empty values | Omitted from the response entirely, never sent as `null` |
| Enumerations | camelCase strings such as `"multiFamily"`, never numbers |
| Lists | Paged by `page` and `pageSize` — see [Pagination](https://api-docs.magicdoor.com/pagination.md) |
| Errors | RFC 7807 problem details, identical across services — see [Errors](https://api-docs.magicdoor.com/errors.md) |

## Permissions

Most endpoints require a permission, named in the page's description as a `resource:action` string such as `leases:read`. An API key carries a subset of its owner's permissions; calling an endpoint the key does not cover returns `403`. See [Authentication](https://api-docs.magicdoor.com/authentication.md) for how to scope a key.

## Trying a call

Every endpoint page carries a cURL sample with the real base URL and example values filled in. Set a token first and the sample runs as-is:

```bash
export MAGICDOOR_TOKEN=$(curl -s \
  --url 'https://auth.magicdoor.com/api-keys/token' \
  --header 'Content-Type: application/json' \
  --data "{\"key\": \"$MAGICDOOR_API_KEY\"}" | jq -r .accessToken)
```

> **Warning: This is the production API**
>
> There is no sandbox. Calls here act on real properties, real tenants, and real money. Read-only endpoints are safe to explore; be deliberate with anything that writes.