Qubihome API

Manage your listings and receive your leads from your own software. The reference below is in English.

OpenAPI document (JSON)Create an API key

The API is available on the Agency and Developer plans for verified agents and agencies. Create keys under Integrations.

Quick start

curl https://qubihome.vercel.app/api/v1/listings \
  -H "Authorization: Bearer qh_live_..."

curl -X POST https://qubihome.vercel.app/api/v1/listings \
  -H "Authorization: Bearer qh_live_..." \
  -H "Content-Type: application/json" \
  -d '{"category":"apartment","transaction":"sale","title":"Bright flat near the park",
       "description":"Two rooms, renovated kitchen, balcony facing south.",
       "price":245000,"currency":"EUR","country":"PL","city":"Krakow",
       "latitude":50.0614,"longitude":19.9366,"area_m2":52,"rooms":2}'

Endpoints

Method	Path	What it does	Scope
GET	/api/v1/listings	List your listings	listings:read
POST	/api/v1/listings	Create a draft listing	listings:write
GET	/api/v1/listings/{id}	Get one of your listings	listings:read
PATCH	/api/v1/listings/{id}	Update a draft or rejected listing	listings:write
POST	/api/v1/listings/{id}/submit	Send a draft to moderation	listings:write
POST	/api/v1/listings/{id}/status	Change the status of a live listing	listings:write
GET	/api/v1/listings/{id}/media	List photos and floor plans	listings:read
POST	/api/v1/listings/{id}/media	Import a photo or floor plan from a public https URL	listings:write
DELETE	/api/v1/listings/{id}/media/{mediaId}	Remove a photo or floor plan	listings:write
GET	/api/v1/leads	List contact requests sent to you	leads:read

Rules

Authenticate every request with Authorization: Bearer YOUR_KEY.
Listings you create are drafts. Submitting sends them to moderation; they go live only after approval, exactly as in the web app.
120 requests per minute per key. Exceeding it returns HTTP 429. Your plan's listing limit applies to submissions.
Errors are JSON with an "error" object holding code, message and details, plus a matching HTTP status.
Photos are imported from public https addresses. Redirects and private addresses are refused.

Webhooks

Each delivery is a POST with a JSON body and these headers. Verify the signature before trusting the payload.

X-Qubihome-Event: lead.created | listing.published | listing.status_changed
X-Qubihome-Delivery: <delivery id>
X-Qubihome-Signature: t=<unix seconds>,v1=<hex HMAC-SHA256 of "<t>.<raw body>">

// Node.js
import { createHmac, timingSafeEqual } from "node:crypto";

function verify(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(parts.t)) > 300) return false;
  const expected = createHmac("sha256", secret).update(parts.t + "." + rawBody).digest("hex");
  return timingSafeEqual(Buffer.from(parts.v1, "hex"), Buffer.from(expected, "hex"));
}

Answer with any 2xx status within 8 seconds. Failed deliveries are retried up to six times with growing delays.