Aestar / Docs / API reference

API reference

What your own website and tools can actually call today — and a straight answer about everything that is browser-only.

The honest version first: Aestar does not have a public API with API keys. There is no key to issue, no token to rotate and no REST surface over your jobs, customers or invoices. If you came here looking for one, the short answer is "not yet" and the long answer is below.

What does exist is a small number of endpoints your own website or tooling can reach without a browser session. They are documented here exactly as they behave.

Send a job request from your own website

This is the useful one. If you have your own website and want its contact or request form to land in Aestar, post to this endpoint instead of emailing yourself.

POST https://aestarai.com/api/lead
Content-Type: application/json

{
  "source": "shop-site",
  "slug":   "your-shop-slug",
  "name":   "Dana Whitfield",
  "phone":  "+14805551212",
  "email":  "dana@example.com",
  "message":"Upstairs unit is not cooling. Available Thursday.",
  "service":"No cooling",
  "channel":"form"
}

Fields

Field	Required	Notes
`source`	Yes	Must be `"shop-site"` to route the request to your shop.
`slug`	Yes	Your shop's slug, the one in your Aestar website address. Lowercase letters, numbers and hyphens.
`name`	One of these	Trimmed to 80 characters.
`phone`	One of these	Trimmed to 24 characters.
`email`	One of these	Lowercased, trimmed to 90 characters.
`message`	No	What they need. Trimmed to 600 characters.
`service`	No	Trimmed to 80 characters.
`requested_iso`	No	A requested time as an ISO date, e.g. `2026-10-02T09:00`. Ignored if it is not one.
`channel`	No	`"form"` or `"chat"`. Anything else becomes `"form"`.

Responses

Status	Body	Meaning
`200`	`{ ok: true, stored, emailed: false, texted: false }`	Saved to your shop's inquiry list. Nothing was emailed or texted to the customer — see the note below.
`400`	`{ ok: false, error: "bad_slug" }`	The slug is not in the allowed shape.
`400`	`{ ok: false, error: "missing_fields" }`	No way to contact the person.
`404`	`{ ok: false, error: "not_published" }`	The shop exists but its Aestar site is not published yet.
`404`	`{ ok: false, error: "not_found" }`	No shop with that slug.
`429`	`{ ok: false, error: "rate_limited" }`	Too many requests from one address in an hour.
`503`	`{ ok: false, error: "save_failed" }`	We could not store it. Retry.

Two things to be clear about. This endpoint has no authentication. Your slug is public — it is in your website address — so treat an inquiry as an unverified stranger filling in a form, because that is what it is. And it is rate limited per address, so it is a form endpoint, not a bulk import.

If the price book can price what was asked for, an estimate is drafted for you at the same time. Drafted, not sent — see Estimates.

Read your published shop page

GET https://aestarai.com/api/lead?action=shop-site&slug=your-shop-slug

Returns the public content of your Aestar shop page as JSON — your services, prices, hours, service area and review summary. It is the same data the page itself renders, so you can reuse it on your own site without keeping two lists in step. Public, no credential, limited to 60 reads an hour per shop.

Status	Body
`200`	`{ ok: true, site: { … } }`
`400`	`{ ok: false, error: "bad_slug" }`
`404`	`{ ok: false, error: "not_found" }`
`429`	`{ ok: false, error: "rate_limited" }`

Is it up?

GET https://aestarai.com/api/health

Public, unauthenticated, cached for a few seconds. Returns 200 with { ok: true, ts, supabase, checks } when the service and its database are reachable, and 503 with the same shape when they are not. HEAD works too if you only want the status code. Point a monitor at it if you like.

What is not a public API

Everything else in the product is reached by your signed-in browser and nothing else. These are not secret endpoints you could use with a key — there is no key, and they will refuse you:

Jobs, customers, estimates, invoices, the price book, timesheets, team chat, referrals and settings. All of it is behind the aestar_session cookie your browser gets when you sign in.
Billing and checkout. Behind the same session, and additionally locked to requests that came from our own site.
Anything under the admin area. That is ours, not yours.

A request without a browser session gets 401 with { ok: false, error: "unauthenticated" }. Some routes also check that the request came from our own pages — that is a cross-site-request defence, not a credential, and we are not going to describe it as one.

Webhooks we receive

Aestar accepts signed webhooks from the services it uses — the payment processor and the telephony and voice providers. Those are verified against each provider's own signature and are not something you configure or call. Aestar does not send outbound webhooks to you yet.

Not yet

Thing	Status
API keys or tokens for shops	Later
A REST surface over jobs, customers and invoices	Later
Outbound webhooks when something happens in your shop	Later
A published OpenAPI description	Later
Jobber, Housecall Pro, ServiceTitan imports	Later

If you are building something and one of those would unblock it, tell us what you are building. That is genuinely how the order gets decided.

Still stuck?

Ask Ava. She answers questions about Aestar itself — pricing, setup, what she does on a call — and she will tell you when something is not built yet.

Generated from the Aestar codebase at commit ceb26e3, last shipped September 23, 2026. Prices, statuses and screen names on this page are read from the running code, not typed by hand — so this page changes when the product does.