Developers
Build on Estimark.
A documented public REST API, API keys with read and write scopes, and signed outbound webhooks. Everything the app does, your own systems can do too.
Getting started
- 01
Create a key
In Estimark, go to Settings → API and create a key. Keys belong to one company and carry read or write scopes. The key is shown once — store it somewhere safe, because it cannot be retrieved again.
- 02
Send it as a header
Every request carries your key in an X-API-Key header. There is no OAuth dance and no token refresh to implement for server-to-server work.
- 03
Generate a client, or just use curl
The OpenAPI specification is published, so most languages can generate a typed client rather than you hand-writing one. It is a standard OpenAPI 3.1 document.
- 04
Subscribe to events instead of polling
Register a webhook endpoint and Estimark posts to it when something happens — a quote accepted, an invoice paid, a repair raised. Polling an API on a timer to notice a change is slower, noisier, and burns your rate limit.
A first request
curl https://api.estimark.co.uk/api/v1/clients \
-H "X-API-Key: $ESTIMARK_API_KEY"Errors come back as JSON with a detail field. A 422 carries a list of per-field validation problems, a 402 means the feature is not in your plan, and a 429 means slow down.
Common questions
- Is the API included in my plan?
- Yes. The public REST API and webhooks are included on every Estimark plan, including Solo. Rate limits apply per key.
- How do I authenticate?
- Send your API key in an X-API-Key header. Keys are created in Settings → API, are scoped to a single company, and carry either read or write permissions.
- How do I verify a webhook actually came from Estimark?
- Every delivery carries an X-Estimark-Signature header containing an HMAC-SHA256 of the timestamp and body, computed with the secret shown when you registered the endpoint. Recompute it and compare before trusting the payload. The timestamp is inside the signed material, so a replayed request cannot have it rewritten.
- What happens if my endpoint is down?
- Failures are retried with backoff. An endpoint that fails repeatedly is disabled automatically and shown as disabled in your settings, so a dead URL is not retried forever. You can re-enable it once it is fixed.
- Is there a sandbox?
- Not a separate one. Use a trial account as your test environment — every plan includes a 14-day free trial, and a trial account has the same API surface as a paid one.
Current service health is on the status page, also available as JSON for your own monitoring.