AgencyPilotHQ
API Documentation

Developer API

A small, read-only REST API for pulling your agency's data into your own tools, plus outbound webhooks for real-time events. Write access, OAuth, and SDKs are on the roadmap — email support@agencypilothq.com if you need one sooner. Machine-readable spec: OpenAPI 3.0 JSON.

Authentication

Create a key from Settings → API Keys in your dashboard. Send it as a Bearer token on every request.

curl https://agencypilothq.com/api/v1/clients \
  -H "Authorization: Bearer apk_live_xxxxxxxxxxxxxxxxxxxxxxxx"

Keys are scoped to a single agency workspace and can be revoked at any time. Treat them like a password — anyone with the key can read your agency's data.

Base URL

https://agencypilothq.com/api/v1

Endpoints

GET/v1/clients

Returns up to 100 of your most recent clients.

{
  "data": [
    { "id": "cku1...", "name": "Acme Co", "email": "hi@acme.com", "company": "Acme", "createdAt": "2026-01-01T00:00:00.000Z" }
  ]
}
GET/v1/projects

Returns up to 100 of your most recent projects.

{
  "data": [
    { "id": "ckp1...", "name": "Website redesign", "status": "ACTIVE", "clientId": "cku1...", "startDate": null, "endDate": null, "createdAt": "2026-01-01T00:00:00.000Z" }
  ]
}

Try it

Paste a real key from Settings → API Keys and send a live request right from this page.

Your key is only sent to AgencyPilotHQ's own API, directly from your browser — it never touches our servers beyond that request.

Rate limits

Each key is limited to 60 requests per minute. Every response includes X-RateLimit-Limit and X-RateLimit-Remaining headers. Going over returns 429 with a Retry-After: 60header. Recent request history and today's/this week's totals are visible in Settings → API Keys.

Errors

Requests with a missing, invalid, or revoked key return 401 with { "error": "Invalid or missing API key" }.

Webhooks

Add an endpoint from Settings → Webhooks and pick which events to receive. We POST a JSON body to your URL as soon as the event happens — a slow or failing endpoint never blocks the action that triggered it.

Events

  • INVOICE_PAID— an invoice's status changes to Paid
  • CONTRACT_SIGNED — a contract is signed via its public signing link
  • DEAL_WON — a pipeline deal moves to the Won stage
  • AI_GENERATION_COMPLETED — any AI tool or agent finishes a run successfully

Payload

{
  "event": "INVOICE_PAID",
  "data": { "invoiceId": "cki1...", "number": "1001", "totalCents": 50000, "currency": "usd" },
  "timestamp": "2026-01-01T00:00:00.000Z"
}

Verifying the signature

Every request includes an X-AgencyPilot-Signatureheader — an HMAC-SHA256 of the raw request body, signed with the endpoint's secret (shown in Settings → Webhooks). Recompute it and compare before trusting the payload.

const crypto = require("crypto");

const expected = crypto
  .createHmac("sha256", endpointSecret)
  .update(rawRequestBody)
  .digest("hex");

if (expected !== req.headers["x-agencypilot-signature"]) {
  throw new Error("Invalid signature");
}

A failed delivery (non-2xx response, timeout, or network error) is retried up to 3 times with a short backoff before being marked failed. Check the delivery log in Settings → Webhooks — it shows the attempt count for each event.