Trayder.AI

Build on Trayder

A provider-scoped API: every key belongs to one business, carries explicit scopes, and is rate-limited per hour by their plan. Money mutations and lifecycle transitions stay first-party — writes open the same doors the app uses, never new ones.

Authentication

curl https://…/functions/v1/api-v1/jobs \
  -H "Authorization: Bearer tray_sk_…"

Keys are minted by the business owner in Settings → API keys, shown once.
Rotation issues a new secret immediately; the old one works for exactly 24 hours.
Every write requires an Idempotency-Key header — replays return the original response.
Lists support opaque cursor paging (stable under concurrent inserts); offset remains one deprecation cycle.

Webhooks

Subscriptions are configured in-app. Deliveries carry two signatures over the raw body:

X-Trayder-Signature:    sha256=HMAC(secret, body)
X-Trayder-Signature-V2: t=<unix>,s=HMAC(secret, "<unix>." + body)

Verify V2 and reject timestamps outside your replay window; V1 remains for one deprecation cycle. Failed deliveries back off and dead-letter after 5 attempts; any delivery can be replayed once from the app.

Endpoints

get	/customers	List the provider's customers
post	/customers	Match-or-create a customer
get	/customers/{id}	Get one customer
patch	/customers/{id}	Update contact fields (name, email, phone)
get	/jobs	List the provider's jobs
get	/jobs/{id}	Get one job
get	/bookings	List bookings (calendar partners; ordered by starts_at, offset paging)
post	/bookings	Book a currently-offered free slot (409 on a lost race — GET fresh slots and retry)
get	/bookings/{id}	Get one booking
get	/quotes	List the provider's quotes
post	/quotes	Create a DRAFT quote with lines — sending stays first-party
get	/quotes/{id}	Get one quote with its lines
get	/invoices	List the provider's invoices
get	/invoices/{id}	Get one invoice with lines and tax
get	/reviews	List verified reviews (site partners render these)
get	/reviews/{id}	Get one review
get	/site	The provider's published site snapshot (the Duda hook)
post	/enquiries	Inject a lead (the marketing-partner endpoint)
get	/openapi.json	This document

Machine-readable spec: GET /functions/v1/api-v1/openapi.json — no auth required.