Developers
RefurbScore API
REST API for company data, passports, reviews and merchant integrations.
- Base URL
https://refurbscore.com
Authentication
Merchant endpoints require an API key (Pro plan). Pass your key via Authorization Bearer or X-API-Key header.
Authorization: Bearer rs_live_…
# or
X-API-Key: rs_live_…Scroll sideways to read the full command.
Available scopes:
read:companyread:passportwrite:passportwrite:reviewwrite:editwrite:webhook
Score independence
The API exposes trust scores computed from verified data. Paid plans and API access never modify scores.
Rate limits
- Public reads
- 60req/min
- Authenticated
- 300req/min
- Write operations
- 30req/min
Responses include X-RateLimit-Remaining and X-RateLimit-Reset headers.
Endpoints
Paths are relative to the base URL. “Public” endpoints need no API key and are rate-limited per IP address.
- GET
/api/company/{slug}Auth: PublicScope:read:company - GET
/api/company/{slug}/scoreAuth: PublicScope:read:company - GET
/api/company/{slug}/reviewsAuth: PublicScope:read:company - GET
/api/passport/{id}Auth: PublicScope:read:passport - POST
/api/passportAuth: API keyScope:write:passport - POST
/api/reviewsAuth: OptionalScope:write:review - POST
/api/suggested-editAuth: API keyScope:write:edit - POST
/api/webhooksAuth: API keyScope:write:webhook
Examples
curl "https://refurbscore.com/api/company/nomophone"Scroll sideways to read the full command.
curl -X POST "https://refurbscore.com/api/passport" \
-H "Authorization: Bearer rs_live_…" \
-H "Content-Type: application/json" \
-d '{"brand":"Apple","model":"iPhone 13","condition":"A","summary":"128GB"}'Scroll sideways to read the full command.
curl -X POST "https://refurbscore.com/api/webhooks" \
-H "Authorization: Bearer rs_live_…" \
-H "Content-Type: application/json" \
-d '{"action":"register","url":"https://example.com/hook","events":["review.published"]}'Scroll sideways to read the full command.
Events
review.createdreview.publishedpassport.createdpassport.publishedscore.updatedcertification.updated
Security
- All write operations enter admin moderation before publication.
- API keys are stored as SHA-256 hashes — raw keys are shown once at creation.
- Webhook deliveries should verify X-Webhook-Signature (HMAC-SHA256).
- Every request is logged with method, path, status, duration and key prefix.