AutoSync Shop Manager API
Docs OpenAPI autosyncshopmanager.com Get API keys

AutoSync REST API

Read and write your shop's customers, vehicles, repair orders, estimates, inspections, invoices, payments, parts and inventory — and get signed webhooks when anything changes. JSON over HTTPS, OpenAPI 3.

Base URL https://api.autosyncshopmanager.com/api/v1 · Version 3.1.1 · Updated Oct 24, 2026

1. Create a key

Sign in to your shop → Settings → API & webhooks. Pick scopes; the secret is shown once.

Open API settings →
2. Make a call
curl https://api.autosyncshopmanager.com/api/v1/me \
  -H "Authorization: Bearer as_xxxxxxxx_…"
3. Subscribe to events

Register a webhook endpoint and verify the X-AutoSync-Signature header on every delivery.

Webhook guide →

Authentication

Base URL: https://api.autosyncshopmanager.com/api/v1. Every request is scoped to the organization that owns the credential — records of other organizations always return 404.

API keys — create one under Settings → API & webhooks in AutoSync with only the scopes you need:

curl https://api.autosyncshopmanager.com/api/v1/customers?per_page=10 \
  -H "Authorization: Bearer as_xxxxxxxx_…"

OAuth 2.0 client credentials — exchange an OAuth client's ID and secret for a 1-hour access token:

curl -X POST https://api.autosyncshopmanager.com/oauth/token \
  -u "$CLIENT_ID:$CLIENT_SECRET" \
  -d grant_type=client_credentials -d "scope=customers:read repair_orders:read"

# → {"access_token":"oat_…","token_type":"Bearer","expires_in":3600,"scope":"customers:read repair_orders:read"}

Conventions & errors

  • Lists return {"data": [...], "meta": {"page", "per_page", "total", "pages", "has_more"}}. Paginate with ?page= and ?per_page= (max 100); sync incrementally with ?updated_since=2026-01-31T00:00:00Z; search with ?q=.
  • Single records return {"data": {...}}. Create returns 201. Updates use PATCH (or PUT) and change only the fields you send.
  • Money is integer cents. Timestamps are UTC ISO 8601. Write bodies accept JSON or form encoding.
  • Records created or changed through the API emit the same events as the app (e.g. customer.created) and are audited with actor “API”.
StatusMeaning
401Missing, invalid, revoked or expired key/token
402The organization's plan does not include API access (or the account is restricted)
403The credential lacks the required scope
404Not found — including records that belong to another organization
422Validation failed — error.errors maps fields to messages
429Rate limit (per-minute) or daily plan quota reached
{"error": {"status": 422, "message": "Email must be a valid email address.", "errors": {"email": "Email must be a valid email address."}}, "request_id": "9f2c…"}

Rate limits

Each API key has a per-minute limit (default 120/min, configurable per key); responses include X-RateLimit-Limit and X-RateLimit-Remaining. Your plan also sets a daily request cap. Exceeding either returns 429.

Webhooks & signature verification

AutoSync POSTs JSON to your endpoint for subscribed events: ping, customer.created, customer.updated, vehicle.created, appointment.created, appointment.updated, estimate.created, estimate.sent, estimate.viewed, estimate.approved, estimate.declined, repair_order.created, repair_order.updated, repair_order.status_changed, repair_order.closed, inspection.completed, payment.created, invoice.created, inventory.updated.

Each request carries X-AutoSync-Event, X-AutoSync-Delivery and X-AutoSync-Signature: t=<unix>,v1=<hex> where v1 = HMAC-SHA256(secret, t + "." + raw_body). Respond with any 2xx within 10 seconds; failures retry with exponential backoff up to 8 times.

// PHP
[$t, $v1] = [null, null];
foreach (explode(',', $_SERVER['HTTP_X_AUTOSYNC_SIGNATURE'] ?? '') as $part) {
    [$k, $v] = array_pad(explode('=', $part, 2), 2, '');
    if ($k === 't') $t = $v; elseif ($k === 'v1') $v1 = $v;
}
$body = file_get_contents('php://input');
$ok = $t && abs(time() - (int) $t) < 300
   && hash_equals(hash_hmac('sha256', $t . '.' . $body, getenv('AUTOSYNC_WEBHOOK_SECRET')), (string) $v1);
// Node.js
const [t, v1] = ['t', 'v1'].map(k => (req.headers['x-autosync-signature'] || '').split(',').find(p => p.startsWith(k + '='))?.slice(k.length + 1));
const expected = crypto.createHmac('sha256', process.env.AUTOSYNC_WEBHOOK_SECRET).update(`${t}.${rawBody}`).digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1 || ''.padEnd(64)));

Account

GET/api/v1/meCurrent organization, credential, scopes and usage
Example
curl https://api.autosyncshopmanager.com/api/v1/me \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"

Customers

GET/api/v1/customersList customers

Requires scope customers:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • email string — Exact email match
Example
curl https://api.autosyncshopmanager.com/api/v1/customers \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: customers:read
POST/api/v1/customersCreate a customer

Requires scope customers:write. Emits the customer.created webhook event.

Body fields
customer_typefirst_namelast_namebusiness_nameemailphonemobileaddress1address2citystatezippreferred_contactsms_opt_inemail_opt_inmarketing_opt_intax_exempttax_exempt_idfleet_accountreferral_sourcenotes
Example
curl -X POST https://api.autosyncshopmanager.com/api/v1/customers \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"first_name":"Ann","last_name":"Lee","mobile":"3305550100"}'
Scope: customers:write
GET/api/v1/customers/{id}Get a customer (with vehicles)

Requires scope customers:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/customers/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: customers:read
PATCH/api/v1/customers/{id}Update a customer

Requires scope customers:write. Emits the customer.updated webhook event.

Body fields
customer_typefirst_namelast_namebusiness_nameemailphonemobileaddress1address2citystatezippreferred_contactsms_opt_inemail_opt_inmarketing_opt_intax_exempttax_exempt_idfleet_accountreferral_sourcenotes
Example
curl -X PATCH https://api.autosyncshopmanager.com/api/v1/customers/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"first_name":"Ann","last_name":"Lee","mobile":"3305550100"}'
Scope: customers:write

Vehicles

GET/api/v1/vehiclesList vehicles

Requires scope vehicles:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • customer_id integer — Filter by customer
  • vin string — Exact VIN
Example
curl https://api.autosyncshopmanager.com/api/v1/vehicles \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: vehicles:read
POST/api/v1/vehiclesCreate a vehicle

Requires scope vehicles:write. Emits the vehicle.created webhook event.

Body fields (required: customer_id)
customer_idyearmakemodeltrimvinplateplate_statemileageenginetransmissiondrivetrainfuelcolortire_sizeunit_numbernotesis_active
Example
curl -X POST https://api.autosyncshopmanager.com/api/v1/vehicles \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer_id":123,"year":2019,"make":"Ford","model":"F-150","vin":"1FTEW1E53KFA00001"}'
Scope: vehicles:write
GET/api/v1/vehicles/{id}Get a vehicle

Requires scope vehicles:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/vehicles/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: vehicles:read
PATCH/api/v1/vehicles/{id}Update a vehicle

Requires scope vehicles:write.

Body fields (required: customer_id)
customer_idyearmakemodeltrimvinplateplate_statemileageenginetransmissiondrivetrainfuelcolortire_sizeunit_numbernotesis_active
Example
curl -X PATCH https://api.autosyncshopmanager.com/api/v1/vehicles/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer_id":123,"year":2019,"make":"Ford","model":"F-150","vin":"1FTEW1E53KFA00001"}'
Scope: vehicles:write

Appointments

GET/api/v1/appointmentsList appointments

Requires scope appointments:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • customer_id integer — Filter by customer
  • location_id integer — Filter by location
  • status string — Status key
  • from string — Starts at/after (ISO 8601)
  • to string — Starts before (ISO 8601)
Example
curl https://api.autosyncshopmanager.com/api/v1/appointments \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: appointments:read
POST/api/v1/appointmentsBook an appointment

Requires scope appointments:write. Emits the appointment.created webhook event.

Body fields (required: customer_id, starts_at)
customer_idvehicle_idlocation_idappointment_type_idtechnician_idbay_idstatustitlestarts_atends_atduration_minutesservicesnotesis_waiter
Example
curl -X POST https://api.autosyncshopmanager.com/api/v1/appointments \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer_id":123,"starts_at":"2026-10-01T14:00:00Z","duration_minutes":60,"title":"Oil change"}'
Scope: appointments:write
GET/api/v1/appointments/{id}Get an appointment

Requires scope appointments:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/appointments/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: appointments:read
PATCH/api/v1/appointments/{id}Update / reschedule an appointment

Requires scope appointments:write. Emits the appointment.updated webhook event.

Body fields (required: customer_id, starts_at)
customer_idvehicle_idlocation_idappointment_type_idtechnician_idbay_idstatustitlestarts_atends_atduration_minutesservicesnotesis_waiter
Example
curl -X PATCH https://api.autosyncshopmanager.com/api/v1/appointments/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer_id":123,"starts_at":"2026-10-01T14:00:00Z","duration_minutes":60,"title":"Oil change"}'
Scope: appointments:write

Repair orders

GET/api/v1/repair_ordersList repair orders

Requires scope repair_orders:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • status string — Workflow status key
  • state string — open | closed
  • customer_id integer — Filter by customer
  • vehicle_id integer — Filter by vehicle
  • location_id integer — Filter by location
Example
curl https://api.autosyncshopmanager.com/api/v1/repair_orders \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: repair_orders:read
POST/api/v1/repair_ordersCreate a repair order

Requires scope repair_orders:write. Emits the repair_order.created webhook event.

Body fields (required: customer_id)
customer_idvehicle_idlocation_idappointment_idstatusprioritymileage_inpromise_atcustomer_concernis_waitercreate_concern_job
Example
curl -X POST https://api.autosyncshopmanager.com/api/v1/repair_orders \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"customer_id":123,"vehicle_id":456,"customer_concern":"Brake noise","mileage_in":84210}'
Scope: repair_orders:write
GET/api/v1/repair_orders/statusesWorkflow statuses
Example
curl https://api.autosyncshopmanager.com/api/v1/repair_orders/statuses \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: repair_orders:read
GET/api/v1/repair_orders/{id}Get a repair order with jobs & totals

Requires scope repair_orders:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/repair_orders/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: repair_orders:read
PATCH/api/v1/repair_orders/{id}Update a repair order / change status

Requires scope repair_orders:write. Emits the repair_order.updated webhook event.

Body fields
statuswaiting_reasonprioritypromise_atcustomer_concernmileage_inis_waitervehicle_location
Example
curl -X PATCH https://api.autosyncshopmanager.com/api/v1/repair_orders/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"in_progress"}'
Scope: repair_orders:write

Estimates

GET/api/v1/estimatesList estimate versions

Requires scope estimates:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • repair_order_id integer — Filter by repair order
  • status string — Estimate status
Example
curl https://api.autosyncshopmanager.com/api/v1/estimates \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: estimates:read
GET/api/v1/estimates/{id}Get an estimate version with jobs

Requires scope estimates:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/estimates/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: estimates:read

Inspections

GET/api/v1/inspectionsList inspections

Requires scope inspections:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • repair_order_id integer — Filter by repair order
  • vehicle_id integer — Filter by vehicle
  • status string — Status
Example
curl https://api.autosyncshopmanager.com/api/v1/inspections \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: inspections:read
GET/api/v1/inspections/{id}Get an inspection with results

Requires scope inspections:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/inspections/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: inspections:read

Invoices

GET/api/v1/invoicesList invoices

Requires scope invoices:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • customer_id integer — Filter by customer
  • repair_order_id integer — Filter by repair order
  • status string — Status
Example
curl https://api.autosyncshopmanager.com/api/v1/invoices \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: invoices:read
GET/api/v1/invoices/{id}Get an invoice with line items and payments

Requires scope invoices:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/invoices/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: invoices:read

Payments

GET/api/v1/paymentsList payments

Requires scope payments:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • invoice_id integer — Filter by invoice
  • repair_order_id integer — Filter by repair order
  • method string — Payment method
Example
curl https://api.autosyncshopmanager.com/api/v1/payments \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: payments:read
GET/api/v1/payments/{id}Get a payment

Requires scope payments:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/payments/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: payments:read

Parts & inventory

GET/api/v1/partsList parts

Requires scope parts:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • part_number string — Exact part number
Example
curl https://api.autosyncshopmanager.com/api/v1/parts \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: parts:read
POST/api/v1/partsCreate a part

Requires scope parts:write.

Body fields (required: part_number, description)
part_numberdescriptionskubrandmanufacturervendor_idcategorypart_typebarcodecost_centsretail_centscore_centstire_sizeunittaxablenotesis_active
Example
curl -X POST https://api.autosyncshopmanager.com/api/v1/parts \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"part_number":"BP-1234","description":"Front brake pads","retail_cents":8999}'
Scope: parts:write
GET/api/v1/parts/{id}Get a part (with stock by location)

Requires scope parts:read.

Example
curl https://api.autosyncshopmanager.com/api/v1/parts/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: parts:read
PATCH/api/v1/parts/{id}Update a part

Requires scope parts:write.

Body fields (required: part_number, description)
part_numberdescriptionskubrandmanufacturervendor_idcategorypart_typebarcodecost_centsretail_centscore_centstire_sizeunittaxablenotesis_active
Example
curl -X PATCH https://api.autosyncshopmanager.com/api/v1/parts/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"part_number":"BP-1234","description":"Front brake pads","retail_cents":8999}'
Scope: parts:write
GET/api/v1/inventoryStock levels by location

Requires scope inventory:read.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
  • location_id integer — Location
  • part_id integer — Part
  • low_stock boolean — Only at/below minimum
Example
curl https://api.autosyncshopmanager.com/api/v1/inventory \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: inventory:read

Webhooks

GET/api/v1/webhook_endpointsList webhook endpoints

Requires scope webhooks:manage.

Query parameters
  • page integer
  • per_page integer
  • updated_since string — ISO 8601; only records changed at/after this time
  • q string — Free-text search
Example
curl https://api.autosyncshopmanager.com/api/v1/webhook_endpoints \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: webhooks:manage
POST/api/v1/webhook_endpointsCreate a webhook endpoint (secret returned once)

Requires scope webhooks:manage.

Body fields (required: url, events)
urldescriptionevents
Example
curl -X POST https://api.autosyncshopmanager.com/api/v1/webhook_endpoints \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"url":"https://example.com/hooks/autosync","events":["repair_order.created","payment.created"]}'
Scope: webhooks:manage
DELETE/api/v1/webhook_endpoints/{id}Delete a webhook endpoint
Example
curl -X DELETE https://api.autosyncshopmanager.com/api/v1/webhook_endpoints/123 \
  -H "Authorization: Bearer $AUTOSYNC_API_KEY"
Scope: webhooks:manage