API · Webhooks
A REST API to read your reviews, reply to them, send review requests and publish to your Google Business Profiles. Signed webhooks to hear about every new review, every reply and every location change.
A key is all you need to call the API. A URL is all you need to receive events.
Fetch your locations and their reviews, newest first, with rating, text, author and reply.
Send a reply to a review: it is published on Google, or emailed to the author of a review collected by Reputacion.
Your till, CRM or website sends the customer list; Reputacion emails them the review request after the delay you choose.
One post with an image and action button on up to 500 profiles in a single call, now or at a scheduled time. Add photos to your profiles too.
Webhooks send an event to your URL for every review created or updated, every reply and every location change.
Every webhook is signed with HMAC-SHA256. If delivery fails, it is retried up to four times over just over a day.
An admin generates the key from the settings. It gives access to every location in the organisation, and Reputacion only keeps a hashed fingerprint of it. Generating a new key immediately deactivates the old one: that is also what to do if a key has leaked. The settings show the number of calls and the date it was last used.
Two reads: your list of locations, and the reviews of a location, newest first, in pages of up to 100. Four writes: reply to a review, send review requests by email from one of your templates, publish a Google post on 1 to 500 profiles, add up to 10 photos to a profile. The seventh endpoint returns the status of a publication, profile by profile. Full documentation is in the help centre of your account.
One HTTPS URL per organisation receives eight events: location created, updated and deleted; review created and updated; reply created, updated and deleted. Each delivery contains an ID, the type, the date and the data, and carries the X-Reputacion-Signature header, an HMAC-SHA256 signature of the body computed with your secret. Events go out within a minute, and any 2xx response counts as received. Otherwise, delivery is retried after 5 minutes, 30 minutes, 3 hours and then 23 hours.
The API key and webhooks are managed by the organisation's admins.
In Settings, Developer, API, an admin generates the organisation's key. Copy it and keep it somewhere safe.
Pass the key in the X-API-Key header of each request. Responses are JSON, and lists are paginated.
In Developer, Webhooks, enter your HTTPS URL and turn delivery on. Check each signature with your secret.
Yes, in every plan, free trial included, with no API-specific call quota. Replying to reviews, publishing posts and adding photos require an active subscription.
Only the organisation's admins. The key gives access to every location in the organisation.
Add your key in the X-API-Key header of each request. A missing or invalid key returns a 401 error.
No, only one key is active per organisation. Generating a new one deactivates the previous one.
Not yet. The API publishes to Google Business Profiles only. Publishing to Facebook and Instagram is done in the app.
Location created, updated and deleted; review created and updated; reply created, updated and deleted. Every event goes to your URL: filter them by type.
Recompute the HMAC-SHA256 signature of the raw body with your secret and compare it with the X-Reputacion-Signature header. The X-Reputacion-Delivery header identifies the delivery and stays the same across attempts.
Delivery is retried four times: after 5 minutes, 30 minutes, 3 hours and then 23 hours. After that it is marked as failed in the delivery log, and your webhook stays active for later events.
They go out within a minute of the event. A new Google review triggers its event as soon as the sync of your profiles picks it up.
There is no ready-made connector. Any tool that can call an API can, however, trigger a review request after a purchase, or receive our webhooks.
In the help centre of your Reputacion account, on the API & Webhooks page: endpoints, fields, event format and signature checks.
