For your own integrations

Your inventory.
Your workflow.

Create and synchronize listings, receive inquiry events and connect your account to the systems you already use.

Manage API credentials OpenAPI reference

Start with a scoped key

Choose the account you want to connect in your dashboard.
Create a credential with only the permissions your integration needs.
Save the secret on your server. It is displayed once.
Send it in the Authorization header over HTTPS.

Keys are account-specific and expire after one year. Rotate or revoke them from Integrations. Browser-side secrets and shared user passwords are unsuitable for integrations.

API access without plan quotas

Free, Pro and Business have no API request, key or webhook allowances. Account permissions still apply: lead contacts require Pro or Business, and shared team access requires Business. Listing and Free media limits apply equally through the API and dashboard.

Security throttles protect service availability. A 429 response includes Retry-After.

Your first request

curl https://www.boatshowavenue.com/api/v1/account \
  -H "Authorization: Bearer $BSA_API_KEY"

Publish deliberately

Create a complete draft, upload its media, then request publication. New publication requests enter listing review. Read the current ETag and send it with If-Match when updating, deleting, publishing or managing media.

curl https://www.boatshowavenue.com/api/v1/listings \
  -H "Authorization: Bearer $BSA_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: inventory-import-boat-001" \
  -d '{"title":"2024 Example 42","year":2024,"make":"Example",
       "model":"42","length":42,"length_unit":"ft",
       "condition":"used","price":{"amount":"125000","currency":"USD"},
       "location":"Miami","country":"US",
       "primary_category":"REPLACE_WITH_REFERENCE_CODE",
       "description":"A complete description of the boat, its condition and equipment."}'

Retrieve category codes and countries from GET /api/v1/references. Asking prices currently use whole currency units; "125000.00" is also accepted.

Resource	Operations	Scopes
Listings	List, create, read, update, publish, unpublish, archive and soft delete	listings:read, listings:write, listings:publish, listings:delete
Listing media	Read, upload and remove JPEG/PNG/WebP photos, MP4 video and PDF documents	media:read, media:write; listing access is also required
Leads	Read and update active, priority or archived status	leads:read, leads:write
Conversations	Read messages and reply to an existing inbound inquiry	messages:read, messages:send
Account, team, usage	Read the account, members and current allowances	account:read, team:read, usage:read
Webhooks	Create, list, disable and rotate signing secrets	webhooks:manage

Reliable writes and pagination

Every write needs a unique Idempotency-Key. Retrying the same request returns the same result for seven days. Reusing a key with a different body, file, query or If-Match returns 409. A stale ETag returns 412; missing If-Match returns 428.

Listing, lead, conversation and message collections accept limit (1–100), cursor, sort=id or sort=-id, and fields. Listings also support q and status. Follow next_cursor until it is null. Unsupported fields or filters produce a validation error.

Receive signed events

Webhook events contain an event ID, type and resource ID. Retrieve private data using an authorized API credential. Verify BSA-Signature with HMAC-SHA256 over timestamp + "." + the raw request body. Allow at most five minutes of clock skew, compare securely and deduplicate event IDs.

Deliveries retry with increasing delays up to twelve attempts. Events can arrive out of order or more than once. Secret rotation signs with both old and new secrets for 24 hours. HTTPS endpoints must resolve to public addresses.

JavaScript example

// Run on your server; keep the key in an environment variable.
const response = await fetch('https://www.boatshowavenue.com/api/v1/listings?limit=25', {
  headers: { Authorization: `Bearer ${process.env.BSA_API_KEY}` }
});
const result = await response.json();
if (!response.ok) throw new Error(`${result.code}: ${result.detail}`);
for (const listing of result.data) console.log(listing.id, listing.title);

Media and privacy

Listing media is public content. Use marketing photos, videos and brochures; do not upload identity documents or confidential records. Photos are limited to 25 MiB and 40 megapixels; MP4 videos and PDF documents are limited to 100 MiB. Private document storage and malware scanning are not included in this release.

PHP example

$curl = curl_init('https://www.boatshowavenue.com/api/v1/usage');
curl_setopt_array($curl, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_TIMEOUT => 20,
    CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('BSA_API_KEY')],
]);
$body = curl_exec($curl);
$status = curl_getinfo($curl, CURLINFO_HTTP_CODE);
curl_close($curl);
$result = json_decode($body, true, 32, JSON_THROW_ON_ERROR);
if ($status !== 200) throw new RuntimeException($result['detail'] ?? 'Request failed');

Testing, compatibility and integrations

Test credentials work only against the separately configured test environment that issued them. They do not create an automatic production sandbox. Use synthetic inventory and contacts when testing. Obtain the correct test base URL from your deployment administrator.

Version 1 uses additive changes for compatibility. Breaking changes require a new API version and at least 90 days of published deprecation notice. Integrations should ignore unknown response fields. OAuth delegation and ready-made CRM connectors are future work; they are not currently advertised as available.

Compare plans · Discuss a custom integration · API and plan terms

Your inventory.Your workflow.