Developers

Your data, without asking us.

Mint a token in Settings and read your own inventory a minute later. No form, no partnership programme, no call. Everything on this page works today — and where something does not exist yet, this page says so.

Start here

1Settings → API tokens → Create a token.
2Choose only the scopes you need. It is shown once.
3Send it as a bearer token.

curl https://helmdms.vercel.app/api/v1/me \
  -H "Authorization: Bearer helm_YOUR_TOKEN"

If that returns your dealership name, everything else on this page will work too.

Scopes

A token carries only what you ticked. A website feed does not need to read your customers, and a token that cannot is a token that cannot leak them.

units:read	Read inventory
customers:read	Read customers
leads:write	Create leads
service:read	Read repair orders

Endpoints

GET/api/v1/unitsunits:read

Inventory. Filter with status and vertical. Cost basis and floorplan detail are never returned — a website feed should not be able to publish your margins.

curl "https://helmdms.vercel.app/api/v1/units?status=available&vertical=marine&limit=25" \
  -H "Authorization: Bearer helm_YOUR_TOKEN"

{
  "data": [
    {
      "id": "…",
      "name": "2024 Yamaha 275 SD",
      "vertical": "marine",
      "brand": "Yamaha",
      "year": 2024,
      "vin": "YAM10275F324",
      "status": "available",
      "price": 142900,
      "location": "Miami",
      "days_in_inventory": 12,
      "photo_url": null,
      "updated_at": "2026-08-24T14:02:11.000Z"
    }
  ],
  "next_offset": 25
}

GET/api/v1/customerscustomers:read

Customers, without their notes. A note is where somebody wrote something true and private about a person.

GET/api/v1/service-ticketsservice:read

Repair orders. open=true for everything not yet delivered. The AI diagnosis is not returned: it is a working note with a probability in it, not something to quote a customer.

POST/api/v1/leadsleads:write

A lead from your website or a marketplace. Needs a name and either an email or a phone number. Possible duplicates are reported, not refused — somebody enquiring twice is ordinary, and the second one may carry new information.

curl -X POST https://helmdms.vercel.app/api/v1/leads \
  -H "Authorization: Bearer helm_YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name":"Tom Reyes","phone":"305-555-0148","interest":"250 Dauntless","source":"website"}'

GET/api/v1/meunits:read

Which dealership this token belongs to, and what it may do.

Paging

limit defaults to 50 and is capped at 200. When there is more, the response carries next_offset; when there is not, it does not — so loop on its presence rather than counting rows.

When something is wrong

401	Missing, unknown, or revoked token. Replace it.
403	The token is fine and lacks that scope. The message names the one it needs.
405	Right path, wrong method. The Allow header says which.
422	The body is missing something required, and the message says what.
503	The API is not configured on this server. Ours, not yours.

An unknown token and a wrong secret return the same message, so a response cannot be used to confirm a token exists.

Not yet

Outbound webhooks are modelled in the database but nothing is sending them, so do not build against them. Rate limiting is not implemented either — be reasonable, and we will publish a limit before we enforce one. Both are listed here rather than left for you to discover.

Create a token