API & Zapier

Authentication

Create an API key in the app: Settings → API & Zapier → + Create API key (paid plans; account owner only). The full key is shown once — if you lose it, revoke it and create a new one. Send it on every request:

Authorization: Bearer drei_0b12c…

Base URL:

https://vrgnjfatqasljgzrhyub.supabase.co/functions/v1/api/v1

Quick check that a key works (also what Zapier connection tests should call):

curl -H "Authorization: Bearer drei_..." \
  https://vrgnjfatqasljgzrhyub.supabase.co/functions/v1/api/v1/me

Basics

• All requests and responses are JSON (Content-Type: application/json).
• Rate limit: 120 requests / minute / account. Over the limit you get HTTP 429 with a Retry-After header and retry_after_seconds in the body.
• Errors are always {"error": "code", "message": "human explanation"} with a matching HTTP status (400, 401, 403, 404, 405, 413, 422, 429, 500).
• API access requires a paid plan — if the account drops to Free, requests answer 403 api_requires_paid_plan.
• List responses share one envelope: {"total_count": n, "rows": [...], "has_more": true, "limit": 50, "offset": 0}. Page with limit (max 200) + offset.

Endpoints

GET /contacts — export leads

Query parameters (all optional):

Rows are ordered newest-updated first and include more than the in-app CSV export: extra phones/emails, notes, mailing address, opt-out timestamps, tags, and source.

POST /contacts — import leads

Send one contact object, an array of up to 100, or {"contacts": [...], "on_duplicate": "skip"}:

{
  "name": "Jane Seller",
  "role": "seller",
  "email": "jane@example.com",
  "phone": "(512) 555-0134",
  "market": "Austin, TX",
  "tags": ["website-form"],
  "mailing_street": "100 Main St", "mailing_city": "Austin",
  "mailing_state": "TX", "mailing_zip": "78701",
  "notes": "Asked about the Travis Co. lot"
}

• Each contact needs at least one of name, email, phone. Other accepted fields: company, title, contact_type, website, additional_emails / additional_phones (up to 2 each), status.
• role defaults to seller; status defaults to pending. Both are strictly validated — an invalid value is a per-item error, never silently changed. Engaged statuses (replied/qualified/active/notinterested) are accepted with a warning: automated campaign sends skip engaged contacts.
• Duplicates are detected by email (case-insensitive) and by phone in any format ((512) 555-0134 ≡ 5125550134 ≡ +15125550134). on_duplicate: "skip" (default — returns the existing contact's id), "update" (applies your fields to the existing contact), or "create" (allows the duplicate).
• The response reports each item: {"created": 2, "updated": 0, "skipped": 1, "errors": 0, "results": [{"index": 0, "id": "…", "status": "created"}, …]}.
• Imports respect your plan's CRM contact limit — items over the cap come back as crm_limit_reached errors.
• Imported contacts arrive with source: "api", and creating them fires your New lead automations and webhooks like any other lead.

PATCH /contacts/:id

{ "status": "qualified", "add_tags": ["hot"], "remove_tags": ["cold"], "append_note": "Called back — motivated." }

Updatable fields: name, email, phone, company, title, contact_type, market, website, mailing_*, status, role, plus add_tags / remove_tags and append_note (notes are append-only through the API — it never overwrites your existing notes). Opt-out flags and compliance fields are not writable.

POST /contacts/:id/enroll

{ "campaign_id": "…uuid from GET /campaigns…" }

Webhooks (Zapier triggers)

Webhooks push events to your URL the moment they happen. Manage them in Settings → API & Zapier. Events:

Each delivery is one JSON object per POST (never an array — Zapier Catch Hooks split arrays into multiple runs, so we don't send them):

{
  "id": "delivery-uuid",
  "event": "contact.created",
  "created_at": "2026-08-24T18:00:00Z",
  "data": {
    "id": "…", "name": "Jane Seller", "email": "jane@example.com",
    "phone": "(512) 555-0134", "company": "", "role": "seller",
    "status": "pending", "market": "Austin, TX", "tags": ["website-form"],
    "source": "api", "mailing_street": "…", "mailing_city": "…",
    "mailing_state": "…", "mailing_zip": "…",
    "created_at": "…", "updated_at": "…"
  }
}

Delivery behavior:

• Any 2xx response counts as delivered. Anything else retries twice (about 2 and 15 minutes later), then the delivery is marked failed.
• A webhook that fails on every delivery for an extended stretch is paused automatically and the account owner gets an email. Re-enable it in Settings after fixing the endpoint.
• Use the Test button in Settings to fire a sample contact.created event any time.
• Bulk imports fan out honestly — a 2,000-row CSV import with a New lead webhook produces 2,000 events, delivered over the following minutes.

Verifying signatures (optional)

Every delivery carries X-Drei-Event, X-Drei-Delivery, and X-Drei-Signature: t=<unix seconds>,v1=<hex>, where v1 is an HMAC-SHA256 of t + "." + rawBody using your webhook's signing secret (viewable via the Secret button in Settings). Zapier Catch Hooks can't check signatures without a Code step — that's fine; verification is optional. On your own server:

// Node.js
const crypto = require('crypto')
function verify(secret, header, rawBody, toleranceSec = 300) {
  const m = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header || '')
  if (!m) return false
  if (Math.abs(Date.now() / 1000 - Number(m[1])) > toleranceSec) return false
  const expected = crypto.createHmac('sha256', secret)
    .update(m[1] + '.' + rawBody).digest('hex')
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(m[2]))
}

Zapier recipes

Trigger: a new Direct REI lead starts your Zap

• In Zapier, create a Zap with Webhooks by Zapier → Catch Hook and copy the hook URL.
• In Direct REI: Settings → API & Zapier → + Add webhook, paste the URL, pick New lead (and any other events).
• Click Test so Zapier receives a sample record to map fields from.

Action: your Zap creates a Direct REI lead

• Add a Webhooks by Zapier → POST step. URL: the base URL + /contacts.
• Set Payload Type to json — it defaults to form, which the API rejects with a hint. This is the #1 setup mistake.
• Under Headers add Authorization = Bearer drei_….
• Map your data fields: name, email, phone, market, tags…

Alternative trigger: polling

If you'd rather poll than receive webhooks, call GET /contacts?updated_since=<last check> on a schedule — rows are newest-first with stable ids.

Questions? info@directrei.com