AerialReports CRM Public API and Webhooks

Authentication

Every request needs a Bearer token. Generate an API key from Settings → Developer & Zapier inside your CRM account (requires an Enterprise plan). The full key is shown once, so store it when you create it.

Authorization: Bearer ar_live_YOUR_API_KEY

Keys are prefixed ar_live_ for production or ar_test_ for a sandbox-style key — both authenticate the same way and hit your real account data (there is no separate test environment; use a test key when you want to rotate/revoke credentials independently of your production integration).

Quick Start

List your jobs:

curl https://crm.aerialreports.com/api/jobs \
  -H "Authorization: Bearer ar_live_..."

Create a lead:

curl -X POST https://crm.aerialreports.com/api/leads \
  -H "Authorization: Bearer ar_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "first_name": "Jamie", "last_name": "Rivera",
    "phone": "+15125550100", "address": "412 Oak St, Austin, TX",
    "source": "zapier"
  }'

Resources

These resource endpoints follow the same shape: GET (list; supports ?q= text search and ?limit=, default 500, maximum 1000), GET /:id, POST (create), PATCH /:id (update) and DELETE /:id. An API key can reach only the paths in this table. Anything else, such as payments, tasks, conversations and reports, returns 403 for a key and is available in the CRM itself.

Scopes

When you create a key you choose its scopes. A request needs the matching resource:read (GET) or resource:write (everything else) scope, or the * wildcard. A missing scope returns 403.

Available scopes: *, leads:read, leads:write, jobs:read, jobs:write, contacts:read, contacts:write, estimates:read, estimates:write, invoices:read, invoices:write, files:read, files:write, measurements:read, webhooks:read, webhooks:write.

Creating or revoking API keys and registering webhook endpoints is done by a signed-in person in Settings → Developer & Zapier, not with an API key.

Webhooks

Register an endpoint from Settings → Developer & Zapier and we POST a signed JSON payload when an event happens, so you do not have to poll. Endpoints must be reachable http(s) URLs; private and internal addresses are rejected.

Events

Payload

{
  "event": "job.created",
  "created_at": "2026-07-08T18:04:11.000Z",
  "data": { "id": "job_abc123", "client_name": "Jamie Rivera", "...": "..." }
}

Verifying the signature

Every delivery includes:

X-AerialReports-Signature: t=1751234567,v1=8f3c...e21a
X-AerialReports-Event: job.created

Compute the HMAC-SHA256 of {timestamp}.{raw body} using the webhook's signing secret (shown once, when you create the endpoint) and compare to v1:

// Node.js
const crypto = require('crypto');
function verify(rawBody, sigHeader, secret) {
  const [t, v1] = sigHeader.split(',').map(s => s.split('=')[1]);
  const expected = crypto.createHmac('sha256', secret)
    .update(`${t}.${rawBody}`).digest('hex');
  return crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));
}

Failed deliveries retry up to 3 times (immediately, +30s, +5min). Every attempt is logged — the last 50 are shown in Settings → Developer & Zapier.

Connect with Zapier

1. In Zapier, create a Zap with trigger Webhooks by Zapier → Catch Hook.
2. Copy the Catch Hook URL Zapier gives you.
3. In AerialReports CRM, go to Settings → Developer & Zapier → + Add Webhook, paste that URL, and pick which events should fire it (e.g. invoice.paid, sign_request.signed).
4. Save — Zapier will catch a test event, and you can build the rest of your Zap (send to Slack, Google Sheets or other apps Zapier supports) from there.

There is no native Zapier app. To write back into the CRM (for example, create a lead when a new Google Sheets row appears), use Zapier's Webhooks by Zapier → POST action with an API key, targeting a resource endpoint above.

Errors & Limits

• 401 — the API key is missing, invalid or revoked.
• 402 — the endpoint requires a plan tier you are not on (the Developer API itself needs Enterprise).
• 403 — the key lacks the needed scope, or the path is outside the API surface.
• 404 — not found, or belongs to a different account (we never leak existence across tenants).
• 429 — rate limited; back off and retry.
• Write endpoints are limited to 100 requests per minute per IP. Use ?limit= on list calls and webhooks instead of tight polling.