Organization reads

The API key selects one organization. Every operation below reads that organization and nothing else: a record of another organization answers 404, the same answer as a record that does not exist. No operation writes, and no operation opens a door.

A key has no person behind it, so each of these operations means "for this organization", never "for me". Send the key in the x-api-key header, as Authentication shows.

curl --fail-with-body \
  --header "x-api-key: $MYREMOTELY_API_KEY" \
  "$MYREMOTELY_BASE_URL/v1/units/list_open_house_host_candidates"

What you can read

• Units — the days a unit takes no tour, what a timezone change would move, the pre-screening questions in force, the open-house RSVP count, and who can host one.

• Locks — the lock brands, the connectors, the codes an unbind could revoke, how many days ahead a lock holds day codes, and whether the last door-code update of a unit reached its locks.

• Tours and inquiries — the free start times a tour can move to, and one inquiry with the prospect's own contact details and answers.

• Messages and calls — the saved reply texts, the four automated texts, the tour access-code texts, the count of unread incoming messages, and the 50 latest calls.

• People — the organization's users with their roles, the roles themselves, and every permission a role can hold.

• Settings and billing — the pre-screening default, the inbound-call routing, the two listing switches, the state of the retired Showdigs backfill, the billing status and this month's usage.

What no read returns

No answer carries a door code, a PIN, a keyboardPwd, a vendor credential or a vendor token. A code-bearing read names the code by id, type and name only. A message text carries the {{passcode}} placeholder, never a code.

A user row and an inquiry row do carry the email address and the phone number the organization holds: staff read them in the app, and a key of that organization reads the same thing.