Developers

Build on WalkLists

Every door your team knocks can reach your CRM, your warehouse or your own software the moment it happens — with a documented REST API and signed webhooks, not a nightly export.

Read the API reference Get an API key

REST API

Read and write contacts, lists, campaigns and door activity. Keys are scoped to one organisation and you can rotate or revoke them yourself, without talking to us.

Versioned at /api/v1, so your integration is not coupled to our release cycle
Filter by updated_since for a change feed that survives deletes, unlike page offsets
Rate limits and daily quotas returned in response headers, so you can watch your own consumption
One error shape everywhere, so a client can handle failures generically

Included from the Team and Local plans up.

Webhooks

Subscribe a URL and we POST to it as things happen — a contact created, a contact updated, a door logged in the field. No polling, no stale data.

Signed with HMAC-SHA256 and a timestamp, so you can verify it came from us and reject replays
Retried with backoff if you are briefly down, then the endpoint is paused rather than hammered
A delivery log showing exactly what we sent and what you returned
Every payload is the same shape the matching endpoint returns, so one handler covers both

Included on every plan, free ones too.

Start here

Four steps from nothing to reading your own data.

1

Create a key

In WalkLists, go to Account → API keys. You see the key once, at the moment you create it. Give it only the scopes it needs — read is enough to pull data out.

2

Make a call

Send the key as a bearer token. Everything is scoped to that key's organisation.

curl https://walklists.com/api/v1/contacts?sort=-created_at \
  -H "Authorization: Bearer wl_live_your_key_here"

3

Subscribe to events

Add an endpoint under Account → Webhooks. The signing secret is shown once, at that moment. Verify the signature before you trust the body — anyone can POST to your URL.
4

Go deeper

The full reference covers every endpoint, the webhook payloads, signature verification and the retry schedule.

API reference

Every endpoint, parameter and response, with the webhook contract alongside them.

OpenAPI spec

Machine-readable. Generate a client, or open it in any OpenAPI viewer.

Postman collection

Import it, paste a key, and send a real request in under a minute.

What v1 does not do yet

Lists and campaigns are read-only. Creating a list is bound up with import and column mapping, and we would rather design that properly than freeze a thin version of it into v1.
Bulk operations emit one event, not thousands. A CSV import raises a single list.created carrying the counts — a 25,000-row import must not mean 25,000 requests to your server.
Deleting a contact is not exposed. Deletion cascades through routes and results, so it stays in the product where the consequences are visible.

Building something and hitting a wall? Tell us — the gaps that block real integrations get priority.