Smart Capital Center API

Creates a new evaluation account and returns an access token and refresh token right away. No confirmation email is sent, so the account works immediately.

Auth: None

Use when: The user has no SCC account and has asked you to create one for them.

Don't use when: The user already has an account (use login), or already has an API key (skip auth and call the API directly). Never register an account the user did not ask for.

Request body

Content type: application/json

Notes for agents

• Only email and password are required.
• A 409 means the email is already registered. Switch to login and do not retry register.
• The access token expires after 900 seconds (15 minutes). Use it right away to create an API key.
• A 429 means too many sign-ups from this IP address. Wait before retrying; do not loop.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "agent@example.com", "password": "s3cret!"}'

Response 200

Account created — tokens issued.

{
  "status": "success",
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...signature",
    "refresh_token": "def50200b8f1aA-9V0pQrSt...",
    "expires_in": 900,
    "token_type": "Bearer"
  },
  "message": null,
  "code": null
}

Errors

Next: Call createApiKey with Authorization: Bearer <access_token>.

Exchanges an email and password for a short-lived access token and a long-lived refresh token.

Auth: None

Use when: The user has an account and you need a bearer token, usually to create an API key.

Don't use when: You already have a working API key. Every data endpoint accepts the X-API-KEY header, so no login is needed.

Request body

Content type: application/json

Notes for agents

• A 401 can mean wrong credentials, a disabled account, an IP address that isn't allowed, or an account that must sign in through SSO. Report the message to the user; do not loop on retries.
• Never store or repeat the password after this call.
• The valuation calls need an account with API access. Accounts created with register have it. An existing account can still create a key, but if its valuation calls are refused, tell the user their account does not have API access.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email": "user@example.com", "password": "s3cret!"}'

Response 200

Authentication successful — tokens issued.

{
  "status": "success",
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...signature",
    "refresh_token": "def50200b8f1aA-9V0pQrSt...",
    "expires_in": 900,
    "token_type": "Bearer"
  },
  "message": null,
  "code": null
}

Errors

Next: Call createApiKey, or use the bearer token wherever it is accepted.

Trades a refresh token for a new access token and a new refresh token. The old refresh token stops working immediately.

Auth: None

Use when: The access token has expired (after 900 seconds) and you still need bearer auth.

Don't use when: You are using an API key. API keys do not use refresh tokens.

Request body

Content type: application/json

Notes for agents

• Refresh tokens are single use. Save the new refresh_token before doing anything else.
• Sending a refresh token that was already used is treated as a stolen token: every active session for that user is revoked and the call fails with 401. Never retry a refresh with a token you have already sent.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refresh_token": "def50200..."}'

Response 200

Rotation successful — new token pair issued. The old refresh token is now invalid.

{
  "status": "success",
  "data": {
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...newsig",
    "refresh_token": "def50200ROTATED...",
    "expires_in": 900,
    "token_type": "Bearer"
  },
  "message": null,
  "code": null
}

Errors

Next: Replace both stored tokens with the new pair.

Creates a named API key for the signed-in user. The key goes in the X-API-KEY header on every other call.

Auth: Authorization: Bearer <access_token> (or X-API-KEY)

Use when: Right after register or login, or when the user wants a separate key for a new integration.

Don't use when: A working key already exists for this integration. Check with getUserApiKeys first.

Request body

Content type: application/json

Notes for agents

• Send the bearer token from register or login in the Authorization header.
• Omit expiresInDays for a key that never expires. Prefer an expiry when the user hasn't said otherwise, and tell them what you chose.
• data.keyValue is returned only once. Show it to the user once, then mask it (sq_****) in anything you write afterwards.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/public/api-keys \
  -H "Authorization: Bearer $SCC_ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "Valuation integration", "description": "Used by our valuation workflow", "expiresInDays": 365}'

Response 200

API key created successfully.

Standard envelope with data containing:

Errors

Next: Use X-API-KEY: <key> on all /api/v2/public/* calls.

Lists the active API keys for the authenticated user.

Auth: X-API-KEY: <your key> header (or Authorization: Bearer <access_token>)

Use when: Before creating a key, or when the user asks which keys exist.

Notes for agents

• Never print full key values back to the user.

Example request

curl https://app.smartcapitalcenter.com/api/v2/public/api-keys \
  -H "X-API-KEY: $SCC_API_KEY"

Response 200

List of API keys retrieved successfully. Key values are masked.

Standard envelope with data as a list of:

Next: deleteApiKey to revoke one, or createApiKey if none fits.

Deactivates one of the user's API keys. Anything using that key stops working.

Auth: X-API-KEY: <your key> header (or Authorization: Bearer <access_token>)

Use when: The user explicitly asks to revoke a key, or a key has leaked.

Don't use when: Cleaning up on your own initiative. Always confirm with the user first, naming the key.

Parameters

Notes for agents

• 403 means the key belongs to another user. 404 means the id does not exist.
• Do not delete the key you are currently authenticating with unless the user understands the session will stop working.

Example request

curl -X DELETE https://app.smartcapitalcenter.com/api/v2/public/api-keys/42 \
  -H "X-API-KEY: $SCC_API_KEY"

Response 200

API key deleted successfully.

Standard envelope: {"status", "data", "message", "code"}.

Errors

Looks up a street address and returns the land parcels at that location. Each parcel has the countyId and parcelId needed to create a property.

Auth: X-API-KEY: <your key> header

Use when: The user gives you an address and wants a valuation or loan quote.

Don't use when: You already have the county id and parcel id (APN). Go straight to createProperty.

Parameters

Notes for agents

• matchedAddress is the address the geocoder actually matched. If it differs meaningfully from what the user typed, confirm before continuing.
• One address can return several parcels. If there is more than one, show the user the options (property type, units, size) and let them choose. Do not pick silently.
• A 404 or an empty parcels array means no parcel was found at the matched address, and a 400 means the address could not be geocoded. In each case ask the user for a more complete address or the APN.

Example request

curl -G https://app.smartcapitalcenter.com/api/v2/public/valuation/parcels \
  -H "X-API-KEY: $SCC_API_KEY" \
  --data-urlencode "address=123 Main St, Los Angeles, CA 90012"

Response 200

OK.

Standard envelope with data containing:

Errors

Next: createProperty with the chosen parcel's countyId and parcelId.

Registers a parcel as a property in the user's account and returns its numeric propertyId.

Auth: X-API-KEY: <your key> header

Use when: After searchParcels, or whenever you have a county id and parcel id.

Request body

Content type: application/json

Notes for agents

• Idempotent: if the property already exists, the existing one comes back unchanged. It is safe to retry.
• Keep the returned propertyId. Uploads and orders need it.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/public/valuation/property \
  -H "X-API-KEY: $SCC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"countyId": "06037", "parcelId": "5555-012-034", "propertyName": "123 Main St"}'

Response 200

OK.

Standard envelope with data containing:

Errors

Next: uploadDocument if the user has documents for the property, otherwise createOrder.

Uploads a document, such as a rent roll or operating statement, and attaches it to a property. Use the returned document id in createOrder.

Auth: X-API-KEY: <your key> header

Use when: The user has documents for the property (rent roll, operating statement, appraisal) and wants them used in the valuation or loan quote.

Don't use when: The property does not exist yet (call createProperty first), or the user has not given you a file.

Parameters

Request body

Content type: multipart/form-data

Notes for agents

• Only upload files the user gave you, and name them clearly.
• The file is stored right away; data extraction continues in the background.
• Keep the returned data.id and pass it in createOrder documentIds for the same property.
• Set type when you know it, so the right extraction runs. Use OTHER when unsure.
• Every field except file may also be sent as a query parameter.
• A 404 means the property does not exist or belongs to another user.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/public/valuation/upload-to-property/123456 \
  -H "X-API-KEY: $SCC_API_KEY" \
  -F "file=@rent-roll.pdf" \
  -F "name=Rent Roll (123 Main St)" \
  -F "type=RENT_ROLL"

Response 202

Document stored and attached to the property; data is the document.

Standard envelope with data containing:

Errors

Next: createOrder with the returned data.id in documentIds.

Requests a full valuation (FULL) or a loan quote (LOAN) for a property the user owns.

Auth: X-API-KEY: <your key> header

Use when: The property exists and the user has asked for a valuation or a loan quote.

Don't use when: Placing a FULL order without explicit, specific approval from the user.

Request body

Content type: application/json

Notes for agents

• FULL costs $350 and charges a card. Before calling, tell the user the property, the order type and the $350 charge, and wait for a clear yes.
• LOAN quotes are free. cardToken is ignored for them.
• cardToken must be a Stripe token (tok_... or pm_...) created in the user's browser or app. Never invent one, and never ask the user to paste raw card numbers to you.
• documentIds come from uploadDocument on this same property.
• The response data.id is the request id. Check progress with getOrder, at most once a minute, until status is COMPLETED or REJECTED.
• A 402 means the card charge failed. Tell the user; do not retry with the same card token unless they ask.

Example request

curl -X POST https://app.smartcapitalcenter.com/api/v2/public/valuation/order \
  -H "X-API-KEY: $SCC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"propertyId": 123456, "orderType": "LOAN", "documentIds": [9876]}'

Response 200

OK.

Standard envelope with data containing:

Errors

Next: getOrder with the returned data.id.

Returns a valuation or loan-quote request created by createOrder, with its current status. Only the user who placed the order can read it.

Auth: X-API-KEY: <your key> header

Use when: After createOrder, to check whether the valuation or loan quote is ready.

Don't use when: Checking more than once a minute.

Parameters

Notes for agents

• Check at most once a minute.
• Stop when status is COMPLETED or REJECTED; both are final. Report statusLabel and any message to the user.
• Only the user who placed the order can read it. A 404 means the request does not exist or belongs to another user.

Example request

curl https://app.smartcapitalcenter.com/api/v2/public/valuation/order/98765 \
  -H "X-API-KEY: $SCC_API_KEY"

Response 200

Request found; data is the request.

Standard envelope with data in the same shape as the createOrder response. The fields you need most:

Errors