Requests & responses

Base URL, formats and conventions shared by every endpoint of the Vestta API.

On this page

Base URL
Requests
Responses
Data conventions
Caching
Rate limits
OpenAPI

Base URL

All endpoints live under one base URL:

Text

https://api.vestta.app/v1/ext

Paths in this documentation are shown in full — for example GET /v1/ext/properties — so they can be pasted after the host. The v1 segment is the API version; breaking changes would ship under a new version and be announced in the changelog.

Requests

Use HTTPS. Request and response bodies are JSON encoded as UTF-8.
Send Content-Type: application/json with every POST body.
Query parameters are case-sensitive. Unknown query parameters are ignored.
Authenticate every request with your key — see Authentication.

Responses

Successful responses have status 200 and carry "status": "ok". Responses that read data put it in data:

JSON

{
  "status": "ok",
  "data": [ … ],
  "count": 78,
  "limit": 20,
  "offset": 0,
  "authenticated_as": "Inmobiliaria Ejemplo"
}

authenticated_as is the name of the workspace that owns the key — useful in logs when one service talks to several workspaces.

Errors use a different shape, with a detail field. See Errors.

Data conventions

Kind	Convention
IDs	Integers, unique per resource: `"id": 1355`.
Timestamps	ISO 8601 with UTC offset: `"2026-09-26T19:38:41.390976+02:00"`.
Money	Numbers in euros, without currency symbols.
Phone numbers	E.164: `"+34600111222"`.
Missing values	Fields without a value are usually omitted rather than returned as `null`. Treat a missing field as `null`.
Vocabulary	Business values are stored in Spanish, as in the Vestta app: `venta`, `alquiler`, `disponible`, `demandante`. Each field's values are listed in the reference.

Build integrations that ignore fields they do not know. New fields can be added to responses without a new API version.

Caching

Responses are sent with Cache-Control: no-store: they always reflect the current state of the workspace and must not be cached by proxies. If you cache on your side — for example to render a listings page — keep the cache per workspace and refresh it periodically.

Rate limits

The API does not currently enforce per-key rate limits. Keep traffic proportionate: cache what you can and avoid polling in tight loops. Any future limit will be announced in the changelog.

OpenAPI

The full contract is published as OpenAPI 3.1 at /openapi.json. It is the same schema the reference pages of this site are generated from, so you can import it into Postman, Insomnia or a client generator and get exactly what is documented here.