API Report Card · Listings, Applications & Tenant Screening · Methodology v1.1
Showdigs
Where the points came from.
Five categories, each worth a fixed share of the 100 points. A category earns the fraction of its checks it passes, times its maximum.
Functional Coverage
Design & Reliability
Access Control
Docs & AI-Ready
Access & Cost
Letter grades are absolute, never curved.
The same numeric bands apply to every platform. Nothing here is scored relative to the rest of the board.
What this means for you.
One paragraph per category, in plain language.
1 · Functional Coverage
You can list and read your units and listings, push properties and listings in, drop prospects into Showdigs' scheduling funnel, order inspections, and receive webhooks for the prospect, tour and inspection journey. The real gaps: there is no way to read, book or cancel a tour through the API, because tours exist only as webhook events. Inquiries and condition reports are write-only, so you cannot query them back. There is no endpoint for scheduling or screening templates. And change notification runs one way only: no webhook fires when a listing or property changes, which can happen through a PMS sync rather than your own action, and there is no updated-since filter to catch it.
2 · Design & Reliability
The API is a clean, modern REST interface with usable errors and genuinely good pagination, and it does emit rate-limit headers. But building production automation on it takes defensive engineering. You have to coerce inconsistently typed fields, since bedrooms comes back as a string while bathrooms comes back as a number. You get no request id to hand support. There is no protection against two writers overwriting each other. Idempotency is not documented, so a retried write can duplicate. Webhook deliveries carry no signature and no retry contract. And there is no status page to watch. Fine for internal tooling, below the bar you would want for mission-critical, high-volume sync.
3 · Access Control
This is the weakest area and it carries a real security implication. You get one powerful token that can do everything the API allows. You cannot hand a limited or read-only slice to a third-party app or an AI agent, you cannot issue separate keys per integration, and, most importantly, if that token leaks there is no self-serve way to revoke or rotate it. Treat the token as a high-value secret, and if it is ever exposed, contact Showdigs support immediately. This rests on the operator's own observation of the settings page rather than a screenshot, and the report commits to revising it if a control was missed.
4 · Docs & AI-Ready
A developer can build from the reference, but not smoothly. Every documented example uses localhost as the base URL, so the real host is never actually stated and has to be inferred. Both of the machine-readable files Showdigs advertises are broken: the OpenAPI spec returns a server error and the Postman collection is missing. There is no SDK, no MCP server, and no AI-readable documentation corpus, so there is nothing to generate a client from or feed to a coding tool. Expect more hand-coding and reverse-engineering than a well-tooled API requires, and no reliable changelog to watch for breaking changes.
5 · Access & Cost
This is the API's strongest area. If you already have a Showdigs account, the API is right there: a self-serve token, no upsell, no gatekeeping. Showdigs sells a single plan at $1.20 per unit per month with a $120 minimum, and API access is not a paid add-on and not reserved for a higher tier. Nothing about cost or access stops you from building today.
Every check, and why it scored that way.
The same 27 checks are applied to every platform. What changes is which are N-A and what the core objects mean for that kind of software. Each mark below is quoted from the run's own report.
Category 1 · Functional Coverage
7.5 / 15Object coverage
weighted coverage = 72.5% (Σ 14.5/20; no critical object absent). Properties/Units/Listings=1.0; Inquiries=0.5 (write-only, no REST read); Tours=0.5 (event-only); Pre-screening=0.5 (event-only); Condition reports=0.5 (no read); Coverage=1.0; Templates=0.0. (All three runs = partial; sub-scores ranged 67.5–72.5%.) [api.showdigs.com/docs/ Units, Listings, Inquiries, Condition reports, Properties, Agent Coverage; live GET /units, /listings 2026-09-10]
Core operational actions
weighted coverage = 84.6% (Σ 11/13; no critical write absent), just under the 0.85 yes threshold. Listing create/update, inquiry create, property create/update, condition-report create all 1.0; webhook subscription 1.0; book/modify tour 0.0 (no endpoint — prospects self-schedule via the returned scheduling_url). All three runs = partial. Documentation-graded (write). [api.showdigs.com/docs/ Create/Update a Listing, Create an inquiry, Create/Update a Property, Schedule a condition report, Webhooks subscribe]
Delete or lifecycle actions
weighted coverage = 77.8% (Σ 7/9; no critical lifecycle absent). Listing DELETE (deactivate) 1.0, listing PUT 1.0, condition-report DELETE (cancel) 1.0; tour cancel/complete 0.0 (not operator-actionable via API). Documentation-graded (write). [api.showdigs.com/docs/ Delete listing, Update a Listing, Cancel a condition report]
Change notification
webhooks cover the prospect→tour→inspection lifecycle (new_inquiry, disqualified_lead, tour_scheduled, tour_completed, tour_cancelled, completed_condition_report), but there are NO events for listing or property/unit changes (which can occur via PMS sync, not only operator action) and no updated-since polling fallback; weighted push coverage of critical+important state changes ≈ 0.64–0.72, below the 0.85 yes threshold. [api.showdigs.com/docs/ Webhooks; live GET /webhooks/sample 2026-09-10] (Reconciled yes→partial: 2 of 3 independent graders scored partial on the evidence.)
Category 2 · Design & Reliability
3.3 / 10Modern API conventions
resource-oriented REST with standard GET/POST/PUT/DELETE verbs and JSON bodies. [api.showdigs.com/docs/; live 2026-09-10]
Consistent typing
a core field is stringly typed and types vary across endpoints: bedrooms:"2"/"4" (string) beside bathrooms:1/2.5 (number) in both /units and /listings; webhook cost:"20" (string) vs tour charge:49 (number); inquiry_id documented as "4789" (string) but returned 2394 (number) live; and the webhook prospects[] array mixes phone_number and phone keys. [live GET /units, /listings, /webhooks/sample 2026-09-10; api.showdigs.com/docs/ Webhooks]
Structured errors
correct HTTP status semantics (401/404/422) with a human-readable message and Laravel errors{} for validation, but no populated stable machine-readable error code across endpoints (only an occasional ad-hoc error:"existingInspection"). [live 401 {"message":"Unauthenticated."}, 404 {"message":"Unit not found."}, 422 {"message":...,"errors":{...}} 2026-09-10; api.showdigs.com/docs/ Schedule a condition report]
Duplicate prevention
no idempotency-key or request-ID mechanism is documented, and the most consequential communicating write (POST /inquiries, which contacts a real prospect) can create duplicate prospects/outreach on retry. Natural idempotency exists only incidentally and undocumented (condition-report in-progress guard — 422 "existingInspection"; property origin_id upsert), which is a defensible basis for "partial" but was resolved to "no." Documentation-graded. [api.showdigs.com/docs/ Schedule a condition report, Create a Property, Create an inquiry] (Reconciled partial→no: 2 of 3 independent graders scored no.)
Graceful handling under load
responses carry X-RateLimit-Limit: 180 and X-RateLimit-Remaining (standard, machine-readable throttle signalling), but rate limiting is undocumented and no 429/Retry-After recovery guidance is published (limit not breached in testing to avoid throttling the production key). [live response headers 2026-09-10]
Pagination for large collections
offset pagination (page/per_page≤100) with a full Laravel paginator observed live (total:1549, last_page, populated next/prev and a links[] array), usable to traverse the whole collection; but no documented stable-ordering guarantee, so rows can shift between page fetches during a long sync. [live GET /units?page=1/2 2026-09-10; api.showdigs.com/docs/ Get all units]
Bulk or incremental export
full datasets are obtainable via list endpoints without per-record calls for units (paginated) and listings (full set), but there is no updated-since incremental sync, no dedicated bulk/export path, and no list endpoint at all for inquiries, tours, or condition reports. [api.showdigs.com/docs/ Get all units, List all listings; live 2026-09-10]
Webhook security and delivery reliability
deliveries can be authenticated via an optional shared "webhook access token" echoed as Authorization: Bearer TOKEN, but there is no HMAC/per-payload signature, no documented retry policy, and no replay/idempotency guidance for consumers. Documentation-graded. [api.showdigs.com/docs/ Webhooks → Webhook Access Token]
Concurrency and conflict control
no ETag/If-Match, version fields, or documented 409 conflict semantics; PUTs are last-write-wins and no ETag header appears on responses. [api.showdigs.com/docs/ Update a Listing, Update a Property; live response headers 2026-09-10]
Versioning and backward compatibility
an explicit path version exists (/api/v1/), but no documented backward-compatibility policy (breaking vs non-breaking) and no deprecation window/notice. [api.showdigs.com/docs/ endpoint paths]
Request traceability
no request/correlation identifier on any response header, and none documented. [live response headers 2026-09-10 — only Date, Content-Type, Server, Vary, Cache-Control, X-RateLimit-*, X-Frame-Options, X-XSS-Protection, X-Content-Type-Options]
Service availability and status transparency
no public status page (status.showdigs.com does not resolve; showdigs.statuspage.io redirects to Atlassian marketing) and no published uptime/SLA. [absence checks 2026-09-10]
Category 3 · Access Control
0 / 5Read-only credentials
no read-only credential/identity can be issued; a single all-purpose Bearer token is used. [operator first-party observation of Business Settings → Integrations, 2026-09-10; api.showdigs.com/docs/ Authenticating requests]
Scoped credentials
the token cannot be restricted to specific resources, actions, or a role; it is all-or-nothing. [operator first-party observation, 2026-09-10]
Multiple keys
the operator cannot create multiple distinct credentials for separate integrations. [operator first-party observation, 2026-09-10]
Rotation and revocation
no self-serve mechanism to rotate/regenerate or revoke the token is available to the operator. [operator first-party observation, 2026-09-10]
Test and production isolation
no sandbox/test environment exists. [no test environment evidenced in docs or site]
Category 4 · Docs & AI-Ready
1.3 / 5Complete self-serve reference
a complete, example-rich Scribe reference covers the core endpoints with worked request/response examples, but every example uses http://localhost as the base URL (the real host is never stated), and the webhook subscribe/unsubscribe request bodies are under-documented (example url is just "https:"), so a developer must infer the real base URL and webhook payload. [api.showdigs.com/docs/ Introduction, all endpoints, Webhooks subscribe]
Reliable machine-consumable integration path
the two advertised machine-consumable artifacts are both broken (View OpenAPI spec → docs.openapi returns HTTP 500; View Postman collection → docs.postman returns HTTP 404), there is no official SDK and no MCP server, and the per-endpoint multi-language snippets are copy-paste examples, not a spec/SDK. (A first-party Zapier app exists but is a no-code connector within Zapier, not one of the qualifying build mechanisms.) [api.showdigs.com/docs/ menu links; live 500/404 across Accept variants 2026-09-10; help.showdigs.com Zapier integrations]
AI-readable documentation
no llms.txt/llms-full.txt (422), no per-endpoint Markdown, and no downloadable plain-text/Markdown corpus; the single Scribe HTML page is human documentation, not a resource structured for AI retrieval. [absence checks 2026-09-10]
Kept current
the only currency signal is the reference's "Last updated: August 4, 2026" date (plus a few inline forward-looking notes); there is no changelog, release notes, or deprecation guidance. [api.showdigs.com/docs/ footer "Last updated"]
Category 5 · Access & Cost
15 / 15Self-serve API key
an entitled operator retrieves the token self-serve from Business Settings → Integrations, with no sales call, support ticket, or key-approval step; confirmed by the operator obtaining and using a working production token. [api.showdigs.com/docs/ Authenticating requests: "You can retrieve your token by visiting your integrations settings page."; operator token verified live 2026-09-10]
Not commercially gated
Showdigs sells a single plan ($1.20/unit/month, $120 minimum); API access is not locked behind a premium/top-tier upgrade and is not shown as a paid add-on. The ~100-unit account minimum is a commercial-scale threshold for the product itself, not API-specific gating. [www.showdigs.com/pricing]
What works
- A self-serve token from Business Settings, with no sales call and no approval step
- One plan at $1.20 per unit per month, with no API upsell and no add-on
- A clean REST API with standard verbs and JSON, confirmed live
- Genuinely good pagination: a full paginator with totals, verified across pages live
- Machine-readable rate-limit headers on every response
- Webhooks across the whole inquiry, tour and inspection lifecycle
- An example-rich reference covering the core endpoints with worked requests and responses
- Full create, read, update and delete on listings, the object the product is built around
- Properties and units can be pushed in and kept in sync from your own systems
- Condition-report inspections can be ordered and cancelled through the API
What to watch
- One all-powerful token, with no read-only or scoped option
- No way to issue separate credentials for separate integrations
- No self-serve way to rotate or revoke the token if it leaks
- Tours are webhook events only: you cannot read, book or cancel one through the API
- Inquiries and condition reports are write-only, with no way to query them back
- No webhook fires when a listing or property changes, and no updated-since filter catches it
- No idempotency, so a retried inquiry can contact a real prospect twice
- Both advertised machine-readable files are broken: the spec 500s, the Postman collection 404s
- Every documented example uses localhost, so the real base URL is never stated
- No request id on any response, and no status page to check when something breaks
The bottom line for a property manager
Showdigs has a real, first-party REST API that is easy to get into, with a self-serve token, a single plan and no upsell, and it covers its core leasing-showing job well. You can sync properties and listings, push prospects into its self-scheduling funnel, order condition-report inspections, and receive webhooks across the inquiry, tour and inspection lifecycle. What you can build today is solid listing sync and lead and inspection automation with event-driven notifications. What you cannot build well is anything that needs to read or manage tours through the API, since they are webhook-only, anything that needs to query inquiries or inspections back, or anything running at mission-critical scale. The API lacks consistent typing, request ids, concurrency control, documented idempotency, signed and retried webhooks, a status page, and any working spec or SDK. The most serious limitation is access control: a single all-powerful token with no read-only or scoped keys and no self-serve rotation or revocation, so guard it carefully. Showdigs is not a bank, not a PMS and not a trust-accounting system, and it does not handle applications, leases or funds. It is a leasing and showing layer that sits on top of your PMS, which you still need for the rest. Net: a genuinely useful integration surface for leasing automation, held to a failing grade by production-hardening and credential-security gaps. One non-scopable, non-revocable token, thin operability, one-directional change notification, and no working specification or SDK.
Check it yourself.
Both files behind this page, in full.
Showdigs’s full report
The complete markdown report this page is built from, including the evidence packet, the run metadata and every check in full.
Download the Showdigs reportThe grading file
The exact rubric behind every score on this page. Same file, every platform. Run it yourself and compare.
Download the methodologyFound a factual error in your grade?
Tell us and we will fix it. Every mark on this page traces to a specific piece of first-party evidence or a live API call, and the full report is published so you can see exactly what was checked and what it was checked against.
Confirmed factual errors are corrected immediately.
Everything else waits. We do not rescore piecemeal on request, because a board where some vendors have been re-run and others have not is not a fair comparison. Shipped improvements, changed documentation and disagreements about judgement all go into the next full rerun.
Contact us with a factual errorMethodology inspired by SaaStr’s AI Agent API Report Card. Sponsored by Column.