SE SecureEntry

SecureEntry API & webhooks

A small, read-first REST API plus signed outbound webhooks. Create tokens in the admin portal under API tokens.

Authentication

Send your token as a bearer header. Tokens are organization-scoped and carry scopes (read, invite).

Authorization: Bearer se_<prefix>_<secret>

Endpoints

MethodPathScopeDescription
GET/api/v1/health—Service check.
GET/api/v1/occupancyreadCurrent on-site counts per property.
GET/api/v1/visits?limit=&cursor=&status=readVisits, newest first, cursor-paginated.
GET/api/v1/visitors?limit=&cursor=readVisitor profiles, cursor-paginated.
POST/api/v1/invitationsinviteCreate an invitation; returns the 5-digit code.

Pagination

List endpoints return next_cursor. Pass it back as ?cursor=… to fetch the next page; a null cursor means the end.

Create an invitation

curl -X POST https://your-domain/api/v1/invitations \
  -H "Authorization: Bearer se_..." -H "Content-Type: application/json" \
  -d '{"property_slug":"harborview","visitor_name":"Ada Byron",
       "visitor_email":"ada@example.com","start_date":"2026-09-01"}'

Webhooks

Set a Webhook URL (and optional secret) on a property. SecureEntry POSTs JSON on visitor.arrived and visitor.departed:

{
  "event": "visitor.arrived",
  "occurred_at": "2026-09-01T14:03:00+00:00",
  "property_id": "…", "property": "Harborview Studios",
  "visit_id": "…", "visitor": "Ada Byron",
  "category": "guest", "host": "Priya Nair", "status": "checked_in"
}

If a secret is set, requests include an HMAC-SHA256 signature header. Verify it against the raw body:

# Python
import hmac, hashlib
def verify(secret, raw_body, header):
    expected = "sha256=" + hmac.new(secret.encode(), raw_body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)   # X-SecureEntry-Signature
// Node
const crypto = require("crypto");
function verify(secret, rawBody, header) {
  const expected = "sha256=" + crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(header));
}

Honest delivery: in development, email/SMS and (unconfigured) webhooks are logged, never faked. Configure providers via environment variables before production.