← All platforms

API Report Card · PM Software · Methodology v1.1

DoorLoop

Name: DoorLoop API Report Card
Item: DoorLoop
Rating: 72
Author: Peter Lohmann

Preliminary grade

C- 72/100

36.08 / 50 raw

Evidence tier

Baseline verified

Date run

Oct 16, 2026

Evaluating model

Claude Opus 5.5

Verification coverage

25/25 applicable checks = 100%

Live-test battery

Complete for steps 1–5

Checks

27 of 27 scored

NOTE: This grade is produced by an AI analysis run against the same published grading file, which you can download and check here. The scope is deliberately narrow: API and data access. It is not Peter Lohmann's opinion of DoorLoop as a software platform, and it says nothing about DoorLoop's features, reliability, interface, support, or standing in the industry.

Where the points came from.

Five categories, each worth a fixed share of the 100 points. A category earns the fraction of its checks it passes, times its maximum.

Category 1

Letter grades are absolute, never curved.

The same numeric bands apply to every platform. Nothing here is scored relative to the rest of the board.

A+97-100

A93-96

A−90-92

B+87-89

B83-86

B−80-82

C+77-79

C73-76

C−70-72

D+67-69

D63-66

D−60-62

Fbelow 60

What this means for you.

One paragraph per category, in plain language.

1 · Functional Coverage

7.5 / 15 points

You can read nearly everything and do the day-to-day ledger work: create leases, move tenants in and out, post charges and payments, record bounced payments, and manage tasks, owners, vendors and bills. You cannot create properties or units, edit or renew an existing lease, read journal entries, reconcile, or handle rental applications through the API. Nothing pushes changes to you, so your tools have to poll on a schedule.

See technical details

2 · Design & Reliability

5.5 / 10 points

The API is plain REST and easy to call. Rate limits are documented with a 429 and Retry-After, and a public status page publishes the API's uptime. Production automations still need defensive code: error formats vary, a retried request can create a duplicate payment or charge, updates overwrite the whole record with no conflict protection, there is no bulk export, and the published field names and types do not always match what the API returns.

See technical details

3 · Access Control

5 / 5 points

With the newer OAuth (v2) path you can give an app or AI agent narrow, read-only or per-resource access and cut it off instantly. The catch is practical: v2 apps must be registered with DoorLoop and currently cover fewer endpoints, the everyday v1 key you create yourself can do whatever its user can do, and there is no sandbox, so every test touches live data.

See technical details

4 · Docs & AI-Ready

3.1 / 5 points

AI coding tools can read DoorLoop's docs page by page in Markdown, which helps. But the downloadable spec link is broken, there are no SDKs, worked examples are sparse, and there is no API changelog. Expect to correct some field names and types by hand, and to find changes by testing rather than reading release notes.

See technical details

5 · Access & Cost

15 / 15 points

On any current plan you can generate your own API key in settings today, with no sales call or upgrade. If you are on a legacy Starter or Pro plan, confirm that your plan includes the API.

See technical details

Every check, and why it scored that way.

The same 27 checks are applied to every platform. What changes is which are N-A and what the core objects mean for that kind of software. Each mark below is quoted from the run's own report. Marks are AI-generated and cover API access only.

Category 1 · Functional Coverage

7.5 / 15

C1.1

Object coverage

. Weighted coverage = 26/38 = 68%.**

Partial

C1.2

Core operational actions

. Weighted coverage = 24.5/38 = 64%.**

Partial

C1.3

Delete or lifecycle actions

. Weighted coverage = 18/25 = 72%.**

Partial

C1.4

Change notification

.**

Partial

Category 2 · Design & Reliability

5.5 / 10

C2.1

Modern API conventions

.** Resource-oriented REST with GET/POST/PUT/DELETE, JSON in and JSON out (reference/introduction: "organized around REST… predictable resource-oriented URLs… standard HTTP response codes, authentication, and verbs"). Confirmed live with JSON responses on /users/me, /properties, and /leases. One limitation: v1 PUT replaces the whole record and does not patch it (reference/put-unit).

Yes

C2.2

Consistent typing

.**

Partial

C2.3

Structured errors

.**

Partial

C2.4

Duplicate prevention

(documentation-graded).**

C2.5

Graceful handling under load

.**

Yes

C2.6

Pagination for large collections

.**

Partial

C2.7

Bulk or incremental export

.** Full datasets can be pulled at up to 1000 rows per page, with filters and sort_by=updatedAt (live-verified above). There is no async export job, bulk endpoint, or documented updated-since sync. The report endpoints (rent roll, P&L, balance sheet, cash flow) are summaries, not data exports.

Partial

C2.8

Webhook security and delivery reliability

.** No webhooks are offered. Their absence is already penalized in C1.4.

N-A

C2.9

Concurrency and conflict control

(documentation-graded).**

C2.10

Versioning and backward compatibility

.**

Partial

C2.11

Request traceability

.**

Partial

C2.12

Service availability and status transparency

.**

Yes

Category 3 · Access Control

5 / 5

C3.1

Read-only credentials

.** v2 OAuth tokens carry only the approved <resource>:<action> scopes, and read means "List and get" (v2.0/reference/authentication §Scopes). Each endpoint declares its scope (for example, GET /leases requires leases:read in the v2 OpenAPI security). A *:read-only token is therefore read-only. Limitation: v2 apps must be registered by contacting DoorLoop (§1). v1 keys inherit the creating user's role, and no read-only v1 role is documented.

Yes

C3.2

Scoped credentials

.** v2 offers fine-grained resource and action scopes (owners:read, tasks:create, tenants:update, …; v2 OpenAPI components.securitySchemes.OAuth2.flows.authorizationCode.scopes). v1 has role-based restriction only ("Each API token is assigned an access role…", reference/authentication, 405 callout).

Yes

C3.3

Multiple keys

.** Keys are named and created per line item ("enter a name for this key in the Key Name field… click Add Line Item… This will create and save a new api key", support article 6457764). The docs also say "view and manage your API keys" (reference/authentication). Live responses carry an x-api-key-id header that identifies the individual key.

Yes

C3.4

Rotation and revocation

.**

Yes

C3.5

Test and production isolation

.** No sandbox or test environment is documented in v1, v2, or the support center, and the spec lists only the "Production" server.

N-A

Category 4 · Docs & AI-Ready

3.1 / 5

C4.1

Complete self-serve reference

.** The reference is public, with an auth guide, pagination, sorting, rate limits, and per-endpoint parameters and schemas (api.doorloop.com/reference/). Only 20 of 96 v1 operations include a worked response example (merged OpenAPI, responses.200.content..example(s)), and error bodies are undocumented. Field names and types also disagree with live data (see C2.2), so some flows still need trial and error.

Partial

C4.2

Reliable machine-consumable integration path

.**

Partial

C4.3

AI-readable documentation

.** Every reference page is available as clean per-endpoint Markdown with the full OpenAPI fragment (<page>.md; all 103 v1 and 39 v2 pages retrieved), and each page's front matter declares agentTools.projectIndex. Limitation: the v1 llms.txt indexes only 2 pages, and llms-full.txt returns 404.

Yes

C4.4

Kept current

.**

Partial

Category 5 · Access & Cost

15 / 15

C5.1

Self-serve API key

.** A company user creates keys in Settings → Company → "Zapier & API Keys" after an SMS identity code and acceptance of the API Terms. There is no sales call or approval step (support article 6457764; reference/authentication). The operator for this run provisioned their own key, and it worked live. Note: the www.doorloop.com/partner page says DoorLoop is "selective about who gets access", and v2 OAuth apps must be registered by contacting DoorLoop. These describe partner and third-party app access, not an operator's own key (see disagreements).

Yes

C5.3

Not commercially gated

.** The base plan, "DoorLoop One", lists "Unlimited users, unlimited document storage and full API access", and the pricing FAQ states that "Everything that used to sit behind Premium, including… the API… is in DoorLoop One" (www.doorloop.com/pricing). The FAQ also says "Existing plans and prices stay as they are", so legacy Starter or Pro customers may still lack access, as the support article 6457764 Zapier note indicates.

Yes

What works

Create a full lease, move tenants in and out, and post charges, credits and payments
Record returned payments and manage tasks, work orders, owners, vendors and bills
Rent roll, P&L, balance sheet and cash-flow reports through the API
Documented rate limits with a 429 and Retry-After, and limit headers on every response
A public status page with a dedicated API component and published monthly uptime
Scoped, read-only OAuth tokens on v2, revocable instantly
Multiple named keys you create yourself in settings
Every reference page available as clean Markdown with its OpenAPI fragment
Full API access on the base DoorLoop One plan, with no sales call

What to watch

No webhooks, so every change has to be found by polling
No creating properties or units, and no editing or renewing an existing lease
No journal entries, reconciliation or rental applications through the API
No idempotency keys, so a retried payment or charge can post twice
Updates replace the whole record, with no conflict protection
Error formats vary and carry no stable machine-readable code
Some published field names and types do not match live responses
The published OpenAPI link returns a 404, and there is no SDK
No API changelog, and no versioning or deprecation policy
No sandbox, so every test touches live data
The everyday v1 key can do whatever its user can do; scoped access needs a DoorLoop-registered v2 app
Writes were graded from documentation, not tested live

Check it yourself.

Both files behind this page, in full.

NOTE: Grades are AI-generated from the published grading file, and cover API access only.

DoorLoop’s full report

The complete markdown report this page is built from, including the evidence packet, the run metadata and every check in full.

Download the DoorLoop report

The grading file

The exact rubric behind every score on this page. Same file, every platform. Run it yourself and compare.

Download the methodology

Found a factual error in your grade?

Tell us and we will fix it. Every mark on this page traces to a specific piece of first-party evidence or a live API call, and the full report is published so you can see exactly what was checked and what it was checked against.

Confirmed factual errors are corrected immediately.

Everything else waits. We do not rescore piecemeal on request, because a board where some vendors have been re-run and others have not is not a fair comparison. Shipped improvements, changed documentation and disagreements about judgement all go into the next full rerun.