RepOS™
Sign in

API Reference

The RepOS External API lets the Command Center (or any authorized system) push data into RepOS and read execution data back out, and lets RepOS notify your systems the moment something happens. Data flows both ways.

Base URL & auth

All endpoints live under https://reposcrm.com/api/external/v1. Authenticate with an API key (issued in the RepOS Admin portal) in the Authorization header. Keys carry a read and/or write scope.

curl https://reposcrm.com/api/external/v1 \
  -H "Authorization: Bearer rk_live_xxxxxxxxxxxx"

Every record you send carries an externalId — your Command Center's own ID for it. RepOS keys off that, so sending the same record twice updates it rather than duplicating. Safe to retry.

Push data in

Send one object or an array (up to 500). Response reports created, updated, and any per-row errors.

POST/dealerswrite scope
Upsert dealers, prospects, and contractors. Assign to a rep with ownerEmail.
POST/contactswrite scope
Upsert contacts under a dealer (by dealerExternalId).
POST/orderswrite scope
Upsert orders. RepOS updates the dealer's order-recency (which drives health), notifies the owning rep, and accepts optional item detail for the pre-visit top-items view.
POST/account-financialswrite scope
Upsert the current accounts-receivable balance and as-of timestamp for each dealer's pre-visit snapshot.
POST/commissionswrite scope
Upsert commission entries per rep (by repEmail).
POST/commission-runswrite scope
Start a controlled paid-sales commission run with source-file count, amount, and SHA-256 controls.
POST/commission-runs/{id}/lineswrite scope
Upload normalized paid line items in batches of 500. Reconciled and finalized runs are immutable.
POST/commission-runs/{id}/calculatewrite scope
Calculate estimated entries. A run remains blocked unless its stored lines, source controls, rates, ZIP ownership, and rep configuration reconcile without exceptions.
POST/commission-config/zipswrite scope
Upsert as many as 500 state-aware ZIP territory assignments per request, including explicit non-commissionable House territories.

Example: upsert a dealer

curl -X POST https://reposcrm.com/api/external/v1/dealers \
  -H "Authorization: Bearer rk_live_xxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "externalId": "CC-DLR-4471",
    "type": "dealer",
    "name": "Riverside Outdoor Supply",
    "stage": "active_dealer",
    "city": "Savannah", "state": "GA", "zip": "31401",
    "ownerEmail": "marcus@tru-scapes.com"
  }'

Example: order detail and current receivables

POST /orders
{
  "externalId": "CC-ORDER-10482",
  "dealerExternalId": "CC-DLR-4471",
  "orderNumber": "10482",
  "total": 2480.00,
  "placedAtMs": 1787169600000,
  "items": [{
    "externalId": "CC-LINE-10482-1",
    "itemCode": "DL-12-BZ",
    "description": "12 inch deck light, bronze",
    "quantity": 20,
    "salesTotal": 1800.00
  }]
}

POST /account-financials
{
  "dealerExternalId": "CC-DLR-4471",
  "currentAr": 3275.40,
  "asOfMs": 1787169600000
}

Read data out

All list endpoints accept ?limit=, ?offset=, and ?updatedSince= (ISO date) for incremental sync.

GET/dealersread scope
List accounts. Filter by ?type=.
GET/activitiesread scope
Visits, calls, and notes logged by reps. Filter by ?dealerExternalId=.
GET/opportunitiesread scope
Sales opportunities with stage and value.
GET/ordersread scope
Synced orders, including any item detail supplied with them.
GET/account-financialsread_sensitive scope
Current receivables snapshots. Filter by ?dealerExternalId=.
GET/commissionsread scope
Commission entries.
GET/commission-runsread_sensitive scope
Recent commission run controls, status, totals, and block reasons.
GET/commission-config/zips?zip=12345read_sensitive scope
Inspect the current state-specific owner and effective dates for a ZIP.

Receive events (webhooks)

Register a URL in the RepOS Admin portal and RepOS will POST a signed JSON body when things happen. Verify each request with the signing secret using HMAC-SHA256 over the raw body, compared to the X-RepOS-Signature header.

POST https://your-command-center/repos-events
X-RepOS-Event: activity.created
X-RepOS-Signature: sha256=<hmac of the raw body>

{ "event": "activity.created",
  "createdAt": "2026-07-08T15:04:00.000Z",
  "data": { "id": "…", "type": "visit", "summary": "…" } }

Events: account.created, account.updated, account.stage_changed, contact.created, activity.created, opportunity.created, opportunity.stage_changed, task.completed.

Errors

Errors return a JSON body with a stable code and a human-readable message. 401 = bad key, 403 = missing scope, 400 = validation.

{ "error": { "code": "insufficient_scope",
             "message": "This key needs the \"write\" scope for this endpoint." } }