Skip to content
Business

MoveGuard API

Create an API key in your workspace settings and send it in the X-API-Key header. Keys belong to a workspace; revoke them anytime. All requests are JSON over HTTPS.

Endpoints

Base URL: https://moveguard-api.onrender.com/api/v1

GET/partner/unitsList your units and listings.
POST/partner/unitsCreate a unit. Re-sending the same external_ref returns the existing unit.
POST/partner/requestsCreate an inspection link (move_in, move_out, check_in, check_out, turnover, annual).
GET/partner/requests/{id}Check an inspection's status.
GET/partner/packetsList sealed packets delivered to your workspace (optionally ?unit_id=).
POST/partner/verifyCheck whether a SHA-256 fingerprint matches a sealed photo, packet, or archive.

Example: turnover request after a checkout

curl -X POST https://moveguard-api.onrender.com/api/v1/partner/units \
  -H "X-API-Key: $MOVEGUARD_KEY" -H "Content-Type: application/json" \
  -d '{"label":"Lakeview Loft","kind":"short_term","external_ref":"listing-42"}'

curl -X POST https://moveguard-api.onrender.com/api/v1/partner/requests \
  -H "X-API-Key: $MOVEGUARD_KEY" -H "Content-Type: application/json" \
  -d '{"unit_id":"<unit id>","kind":"turnover","recipient_email":"cleaner@example.com"}'
# => {"request": {...}, "link": "https://.../r/<token>"}

Webhooks

Add an https endpoint in workspace settings. We POST request.started and packet.delivered events with an X-MoveGuard-Signature header: HMAC-SHA256 of the raw body with your signing secret. Reject requests whose signature doesn’t match. Return 2xx quickly; we retry on 5xx.

import hmac, hashlib

def valid(secret: str, body: bytes, header: str) -> bool:
    expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, header)
{"id":"…","event":"packet.delivered","created":"2026-10-14T15:00:00+00:00",
 "data":{"request_id":"…","unit_id":"…","external_ref":"listing-42","kind":"turnover",
         "packet_sha256":"…","archive_sha256":"…"}}

Verifying files

Compute SHA-256 of the file yourself and send only the fingerprint. A match returns when the file was received and sealed, the independent timestamp, and the photo’s source and metadata notes — never who it belongs to.

curl -X POST https://moveguard-api.onrender.com/api/v1/partner/verify -H "X-API-Key: $MOVEGUARD_KEY" \
  -H "Content-Type: application/json" -d "{\"sha256\":\"$(shasum -a 256 photo.jpg | cut -d' ' -f1)\"}"