Developers

RouteOn REST API & Zapier

Connect RouteOn to your CRM, spreadsheets, accounting or chat tools. Every key belongs to one company and only ever sees that company's records. The API never prices, books, charges or messages anyone.

Authentication

The company owner creates keys in Settings → Partners & Integrations → Developers. A key has the read scope and optionally write. It is shown once; RouteOn keeps only a hash. Send it on every request:

curl https://routeon.app/api/public/v1/me \
  -H "Authorization: Bearer ro_live_…"

Limits: 120 requests per minute per key (HTTP 429 above that). Revoking a key stops it at once and switches its hooks off.

Endpoints

Base URL https://routeon.app/api/public/v1. JSON in and out; lists return { "data": [...] }. Times are ISO 8601 in UTC; each booking also carries its pickup-city timezone. Money is a decimal in the company currency.

Method	Path	Scope	What it does
`GET`	`/me`	read	The company and key you are using (Zapier's connection test).
`GET`	`/reservations`	read	Bookings (not quotes), newest first. ?status=, ?updated_since=, ?limit= (≤ 100).
`GET`	`/reservations/{id}`	read	One booking or quote.
`GET`	`/quotes`	read	Open quotes, newest first. ?updated_since=, ?limit=.
`GET`	`/customers`	read	Customers, newest first. ?email= (exact, case-insensitive), ?updated_since=, ?limit=.
`GET`	`/customers/{id}`	read	One customer.
`GET`	`/leads`	read	Website and API quote requests, newest first. ?since=, ?limit=.
`GET`	`/invoices`	read	Issued invoices (no drafts). ?status=paid, ?updated_since=, ?limit=.
`POST`	`/customers`	write	Add a customer {name, email?, phone?, company?}. An existing customer with the same email is returned instead (created: false).
`POST`	`/leads`	write	Add a quote request {name?, email?, phone?, company?, pickup?, dropoff?, trip_at? (ISO 8601 with offset), passengers?, notes?}. Send an Idempotency-Key header so a retry never adds it twice.
`GET`	`/hooks`	read	REST hooks this key subscribed.
`POST`	`/hooks`	read	Subscribe {target_url (public https), event}. Returns id and the signing secret.
`DELETE`	`/hooks/{id}`	read	Unsubscribe a hook this key created.

curl -X POST https://routeon.app/api/public/v1/leads \
  -H "Authorization: Bearer ro_live_…" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: form-8841" \
  -d '{"name":"Dana Lee","email":"dana@example.com","pickup":"YYC Airport","dropoff":"Banff","trip_at":"2026-12-04T09:30:00-07:00","passengers":12}'

Events & REST hooks

Subscribe with POST /hooks; RouteOn then POSTs each event to your URL:

{
  "id": "delivery uuid",
  "event": "lead.created",
  "organization_id": "…",
  "created_at": "2026-10-24T16:02:11.000Z",
  "data": { "lead_id": "…", "name": "Dana Lee", "email": "dana@example.com", … }
}

Headers: x-webhook-event, x-webhook-delivery, x-webhook-timestamp and x-webhook-signature = hex HMAC-SHA256 of the raw body with the hook's secret. Answer 2xx within 10 s; failures retry up to 8 times with back-off. Nothing is delivered while the company has communications paused.

`lead.created`	A quote request arrived (website form, booking widget inquiry, or POST /leads).
`customer.created`	A customer record was added.
`quote.created`	A new quote was created (website drafts excluded).
`reservation.created`	A booking was created.
`reservation.updated`	A booking was edited.
`reservation.signed`	The customer signed the quote or contract.
`reservation.paid`	A booking became paid.
`reservation.completed`	A trip was completed.
`reservation.cancelled`	A booking was cancelled.
`invoice.paid`	An invoice became fully paid.

Errors

{ "error": { "code": "forbidden", "message": "This key needs the write scope" } }

401 missing or revoked key · 403 wrong scope or API not enabled for the company · 404 not found · 422 invalid input · 429 rate limited · 503 feature not installed yet.

Zapier

The RouteOn Zapier app uses this API: triggers for new leads, customers, quotes, bookings, paid bookings and paid invoices (instant, via REST hooks), actions to create a customer or a quote request, and a customer search by email. Paste an API key when Zapier asks to connect.