Customer portal

The buyer / owner / tenant portal (OTP sign-in for contacts): the construction updates members publish for buyers and the referrals portal users send.

GET/v1/portal-referrals

Referrals from the customer portal

Newest first, with the lead each became and who referred it; keyset pagination.

Access: Signed-in members only (web or Android session) — not for API keys. Permission leads.view.

Parameters

cursorquery: Id
Opaque record id.
limitquery: integer

Response · 200

datarequired: array of PortalReferral
metarequired: PageMeta

Request

curl -X GET 'https://api.propzolo.com/v1/portal-referrals' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "status": "received",
      "lead_id": "cmusrceel0000q7kaafxqi1om",
      "note": "string",
      "referrer": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "created_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {
    "next_cursor": "string",
    "has_more": true
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/project-updates/{id}

Edit or publish a construction update

Access: Signed-in members only (web or Android session) — not for API keys. Permission projects.edit.

Parameters

idpathrequired: Id
Opaque record id.

Request body

titlerequired: string
body: string or null
progress_pct: integer or null
publish: boolean
Publish now: buyers with a booking in the project see it.

Response · 200

datarequired: ProjectUpdate
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/project-updates/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"title":"string","body":"string","progress_pct":0,"publish":false}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "project_id": "cmusrceel0000q7kaafxqi1om",
    "title": "string",
    "body": "string",
    "progress_pct": 0,
    "status": "draft",
    "published_at": "2026-10-06T05:30:00.000Z",
    "created_by_id": "cmusrceel0000q7kaafxqi1om",
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/project-updates/{id}

Delete a construction update

Access: Signed-in members only (web or Android session) — not for API keys. Permission projects.edit.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/project-updates/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/projects/{id}/updates

Construction updates of a project

Access: Signed-in members only (web or Android session) — not for API keys. Permission projects.view.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: array of ProjectUpdate
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/projects/{id}/updates' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "project_id": "cmusrceel0000q7kaafxqi1om",
      "title": "string",
      "body": "string",
      "progress_pct": 0,
      "status": "draft",
      "published_at": "2026-10-06T05:30:00.000Z",
      "created_by_id": "cmusrceel0000q7kaafxqi1om",
      "created_at": "2026-10-06T05:30:00.000Z",
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/projects/{id}/updates

Post a construction update

A draft, or published at once (`project_update.published` for automations).

Access: Signed-in members only (web or Android session) — not for API keys. Permission projects.edit.

Parameters

idpathrequired: Id
Opaque record id.

Request body

titlerequired: string
body: string or null
progress_pct: integer or null
publish: boolean
Publish now: buyers with a booking in the project see it.

Response · 201

datarequired: ProjectUpdate
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/projects/{id}/updates' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"title":"string","body":"string","progress_pct":0,"publish":false}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "project_id": "cmusrceel0000q7kaafxqi1om",
    "title": "string",
    "body": "string",
    "progress_pct": 0,
    "status": "draft",
    "published_at": "2026-10-06T05:30:00.000Z",
    "created_by_id": "cmusrceel0000q7kaafxqi1om",
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

{ "data": [ { "id": "cmusrceel0000q7kaafxqi1om", "name": "string", "status": "received", "lead_id": "cmusrceel0000q7kaafxqi1om", "note": "string", "referrer": { "id": "cmusrceel0000q7kaafxqi1om", "name": "string" }, "created_at": "2026-10-06T05:30:00.000Z" } ], "meta": { "next_cursor": "string", "has_more": true } }

curl -X PATCH 'https://api.propzolo.com/v1/project-updates/{id}' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"title":"string","body":"string","progress_pct":0,"publish":false}'

{ "data": { "id": "cmusrceel0000q7kaafxqi1om", "project_id": "cmusrceel0000q7kaafxqi1om", "title": "string", "body": "string", "progress_pct": 0, "status": "draft", "published_at": "2026-10-06T05:30:00.000Z", "created_by_id": "cmusrceel0000q7kaafxqi1om", "created_at": "2026-10-06T05:30:00.000Z", "updated_at": "2026-10-06T05:30:00.000Z" }, "meta": {} }

DELETE/v1/project-updates/{id}

Delete a construction update

Access: Signed-in members only (web or Android session) — not for API keys. Permission projects.edit.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/project-updates/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

{ "data": [ { "id": "cmusrceel0000q7kaafxqi1om", "project_id": "cmusrceel0000q7kaafxqi1om", "title": "string", "body": "string", "progress_pct": 0, "status": "draft", "published_at": "2026-10-06T05:30:00.000Z", "created_by_id": "cmusrceel0000q7kaafxqi1om", "created_at": "2026-10-06T05:30:00.000Z", "updated_at": "2026-10-06T05:30:00.000Z" } ], "meta": {} }

curl -X POST 'https://api.propzolo.com/v1/projects/{id}/updates' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"title":"string","body":"string","progress_pct":0,"publish":false}'