Webhooks and API

Add an endpoint

Sign in, open Integrations from your account, and add your endpoint’s URL under Webhooks. It must be https. Choose the events it receives, or all of them.

Nolan then shows the endpoint’s signing secret once. Keep it with your other secrets: you need it to check that a request came from Nolan. “New secret” replaces it; the old one stops working at once.

“Send test event” delivers a ping event to that endpoint right away, so you can check your receiver before real events arrive.

What Nolan sends

A POST with a JSON body and these headers:

Check the signature

The signature is an HMAC-SHA256, in lowercase hexadecimal, of the timestamp, a period and the raw request body, keyed with the endpoint’s signing secret. Compute it over the body exactly as received, before any JSON parsing.

Refuse the request when no v1 value matches, or when the timestamp is more than five minutes away from your clock. Compare signatures in constant time. While you rotate a secret, check against both.

Node.js

import crypto from 'node:crypto';

// rawBody: the request body exactly as received, as a string.
export function isFromLeaseOwl(rawBody, signatureHeader, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(signatureHeader.split(',').map((part) => part.trim().split('=', 2)));
  const timestamp = Number(parts.t);
  if (!Number.isInteger(timestamp) || Math.abs(Date.now() / 1000 - timestamp) > toleranceSeconds) return false;
  const expected = crypto.createHmac('sha256', secret).update(`${timestamp}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 ?? '', 'hex');
  return given.length === expected.length && crypto.timingSafeEqual(given, expected);
}

Retries and failures

• A delivery succeeds when your endpoint answers with a 2xx status within 10 seconds. Answer first and do the work afterwards.
• Anything else is retried after about 1 minute, 5 minutes, 30 minutes, 2 hours, 6 hours, 12 hours and 24 hours: eight attempts over about two days. Retries run every 15 minutes, so short waits can be longer.
• Delivery is at least once. The same event can arrive twice, and events can arrive out of order: use the event id to skip duplicates, and the timestamps in the data to order them.
• Redirects are not followed. Use the final URL.
• After the last attempt, the delivery is marked failed. Failed deliveries are listed under Webhooks on your Integrations page, with a Retry button.
• An endpoint that answers 410 Gone is turned off. That is how Zapier and Make unsubscribe.

The event

Every event has the same envelope. data holds the objects for its type.

{
  "id": "evt_Qm3c9rT2xV8kLw1sZp4bNg",
  "type": "showing.booked",
  "created_at": "2026-10-07T23:47:12.311Z",
  "api_version": "2026-10-05",
  "organization_id": "4c0d6f3e-2b8a-4f61-9a57-0f3c1d2e8b90",
  "data": {
    "showing": {
      "id": "b7c1f0a2-5d3e-4c8b-8e21-6a9f0d4c3b12",
      "status": "booked",
      "starts_at": "2026-10-09T22:00:00.000Z",
      "ends_at": null,
      "when": "Thursday, October 9 at 6 p.m.",
      "previous_starts_at": null,
      "address": "Rue Saint-Denis near Rue Rachel",
      "listing": { "id": "7f3a1c2d-...", "address": "Rue Saint-Denis near Rue Rachel", "rent": 1950 }
    },
    "lead": {
      "id": "b1e4a9d0-...",
      "name": "Maya Tremblay",
      "phone": "+15145550142",
      "email": "",
      "status": "showing_booked",
      "lost_reason": null,
      "channel": "phone",
      "source": "Kijiji",
      "source_line": "+15145550100",
      "source_page": null,
      "listing": { "id": "7f3a1c2d-...", "address": "Rue Saint-Denis near Rue Rachel", "rent": 1950 },
      "wants": { "move_in": "November 1", "household": "2 adults", "pets": "1 cat", "unit": "Rue Saint-Denis near Rue Rachel" },
      "summary": "Wants the Plateau 4½ for November 1, works nearby, has one cat.",
      "callback_requested": false,
      "owner": null,
      "booking_id": "b7c1f0a2-5d3e-4c8b-8e21-6a9f0d4c3b12",
      "showing_at": "2026-10-09T22:00:00.000Z",
      "showing_outcome": null,
      "created_at": "2026-10-07T23:41:55.120Z",
      "last_contact_at": "2026-10-07T23:47:10.004Z"
    }
  }
}

Event types

The lead object

REST API

Zapier, Make and your own scripts use the same API at https://getnolan.ai/api/v1/. Create a key under “API keys” on your Integrations page. It is shown once.

Send the key in the Authorization header as a bearer token, never in a URL. A key reaches one organization: everything else answers 404.

Add a lead

curl https://getnolan.ai/api/v1/leads \
  -H "Authorization: Bearer $LEASEOWL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "Maya Tremblay", "phone": "514-555-0142", "source": "Kijiji", "summary": "Asked about the Plateau 4½"}'

Errors answer with a status and a JSON body: { "error": { "code": "...", "message": "..." } }.

Versions

Each event carries api_version. New fields and new event types can appear at any time, so ignore what you don’t know. A change that removes or renames a field gets a new version, announced on this page first.

Open your integrations