Shace Partner API
Shace Partner API
Publish your vacant premises to Shace straight from your property system.
Authenticate every request with Authorization: Bearer shace_sk_… (an org-scoped key handed out by Shace).
Push objects and listings by your own reference with PUT /objects/{id} and PUT /listings/{id} whenever they are saved on your side: the same reference updates instead of duplicating, unchanged bodies are no-ops, and listings you do not push are never touched. POST /listings/{id}/unpublish takes a unit off the market.
Anywhere a Shace id is accepted, ext:<your reference> is accepted too.
Errors use the shape { code, status, message, data? }. Validation errors carry issues under data.issues.
Tags
Listings
Units for rent.
PUT /listings/{id} by your own reference is the call to make whenever a unit is saved in your system; POST /listings/{id}/unpublish takes it off the market.Objects
Buildings and addresses. Push them on their own when several units share an address.
Uploads
Listings reference images by URL, and the URLs must come from your organization's uploads through this API. A URL from anywhere else is rejected with
400.
Upload once, cache the URLs. Store the returned URLs next to the unit in your system. Later pushes send the same URLs and the listing comes back unchanged; upload again only when a photo actually changed. Shace checks that each URL points into your organization's folder but does not fetch it, so a URL for an upload that no longer exists is accepted and shows as a broken image.
Deletion. An upload is deleted as soon as no listing in your organization references it any more. If a photo moves between units (unit A drops a URL and unit B gains it), push B before A, or upload the photo again for B. A URL shared by several listings stays as long as one of them keeps it.
Order matters. images is the display order in Shace and the first image is the cover. Reordering the array counts as a change and re-indexes the listing.
Floor plans are optional and do not count towards the three-image minimum. Blur placeholders from the upload response are optional to pass along on the listing; leave them out if your system has nowhere to keep them.
Remote URLs. Accepting your own CDN URLs and fetching them on our side is planned. Until then, the upload endpoints are the way in.Account
The organization and key behind a request, and the amenity catalogue.
Security Schemes
apiKey
Every request carries an organization-scoped API key as a bearer token:
Authorization: Bearer shace_sk_…. A key is shace_sk_ followed by 48 hex characters, and it has full inventory access for its organization and nothing else. There are no scopes yet; if a narrower key is ever needed, say so.
Getting a key. Shace mints keys during onboarding and shows them once, so store the plaintext in your secret manager right away. Shace keeps only a hash and can never show a key again; if one is lost, a new one is issued and the old one revoked. Keys issued for a pilot may carry an expiry: GET /me shows expiresAt, or null for none.
Rotation. Several keys can be live at once, so rotation is: get a new key, switch your job over, ask Shace to revoke the old one. A revoked or expired key answers 401 from the next request.
Server to server only. Keyed routes send CORS headers to this docs site alone, for the Test Request button; every other origin gets none, so a key cannot be used from your own browser pages even by accident. Call the API from your backend or a scheduled job.
Environments. Production keys work against api.shace.se. The preview environment serves the same API with keys minted there and is the sandbox: real code, disposable data. Use a preview key and the preview host for the Test Request button.http