HelpDevelopers
Webhooks and events
One endpoint schedules a request. The same external id is accepted once.
POST /api/v1/events needs an organization API key with events:write and a Growth, Scale, or Franchise plan. The API reads TrustMetrics data and writes a review request. It does not call Google.
Each key allows 600 requests a minute. Each organization allows 50,000 requests a day.
Body
Send JSON. location is an id or an external_ref. contact may include email, phone, first_name, and last_name. consent.email_basis is one of import_explicit, form_checkbox, verbal_logged, or existing_customer. SMS consent is a separate object with granted, source, and captured_at. event.type is job_completed, purchase, appointment_completed, or manual, with occurred_at and external_id.
A successful call returns 202. The same external id returns 409. An invalid field returns 422.
curl -X POST https://trustmetrics-v2.vercel.app/api/v1/events \ -H "Authorization: Bearer tm_ak_live_..." \ -H "Content-Type: application/json" \ -d '{ "location": { "id": "LOCATION_UUID" }, "contact": { "email": "ada@example.com", "first_name": "Ada" }, "consent": { "email_basis": "existing_customer" }, "event": { "type": "job_completed", "occurred_at": "2026-10-25T15:00:00Z", "external_id": "job_1001" } }'
Optional signature
You can send X-TM-Signature: t=<unix>,v1=<hex hmac sha256 of t + "." + raw body>, using the API key as the secret. A missing signature is accepted. A bad signature is rejected. The timestamp must be within 5 minutes.