You likely won't read raw DoorSpot API responses day to day — that's what the connected tool or AI agent is for — but it helps to know these terms if a developer, vendor, or error message mentions them. Go to api.doorspot.com/developer any time for the full technical reference.
Common terms
Pagination: Large lists, like all your reservations, come back in pages rather than all at once. Pass
starting_after(orending_beforeto page backward) with the ID from the last page you saw, and uselimitto control page size (default 25, max 100). Each response includes ahas_moreflag plusnext_starting_after/next_ending_beforemarkers for the next call.Rate limiting: Each API key can make up to 1,000 requests per hour by default. If that limit is hit, the API returns a 429 error until the hour rolls over. Well-built integrations watch for this and slow down automatically.
Idempotency: A safety feature for actions that create or change something, like creating an invoice. Including a unique idempotency key with the request lets a tool safely retry after a network hiccup without accidentally creating a duplicate.
Errors: Every error includes a short code, a human-readable message, and a
request_id. If you contact DoorSpot support about an API problem, that request ID helps us find exactly what happened.
Common error codes
400 — The request was malformed (bad or missing information).
401 — The API key is missing, invalid, or was revoked.
403 — The key is valid but doesn't have permission for that data (a scopes issue).
404 — The specific record requested doesn't exist.
422 — The request was understood but failed a validation rule.
429 — Too many requests — the rate limit was hit.
500 — Something went wrong on DoorSpot's end. If this persists, contact support with the request ID.
Advanced: real-time updates with webhooks
Most integrations work by having the other tool periodically request updates from DoorSpot. If you'd rather have DoorSpot proactively notify another system the moment something happens — a new reservation, a paid invoice, a failed payment — you can set up a webhook instead. This is more technical and is typically set up by a developer:
The API key being used needs the Webhooks permission, with Write access, selected in its scopes.
Your developer registers a webhook by calling the API with the URL that should receive notifications, plus which events to send — for example
reservation.created,invoice.paid, orpayment.failed. Available events cover reservations, invoices, payments, service requests, units, and contacts being created, updated, or changing status.DoorSpot returns a signing secret at that moment, shown only once — store it securely, just like an API key. It verifies that incoming notifications genuinely came from DoorSpot.
From there, webhooks can be listed, updated, deleted, or have their secret rotated at any time via the API.