Pastrata logo

Extension platform

Build an integration with Pastrata. Subscribe to 87 catalogued events over signed webhooks, and read detail through 20 scoped Gateway endpoints — under permissions a building manager granted explicitly.

Gateway API reference

Every /ext/v1 endpoint, the scope it requires, the shape it returns, and the errors it can raise.

Event catalog

Every event you can subscribe to, with its payload schema, PII tier, and a worked example.

How an integration fits together

  1. Enroll as a publisher. A Pastrata operator registers your organization: a verified domain, your signing keys, and a signed data-processing agreement. There is no self-serve enrollment yet.
  2. Publish an extension version. Your manifest declares the scopes you need — each with a reason shown verbatim to the manager who installs it — plus the events you subscribe to and any configuration you accept.
  3. A manager installs it.They see your requested scopes and consent, or don’t. A management company can install across a portfolio, with per-building opt-out.
  4. You receive events and read data. Signed webhooks tell you something changed; the Gateway lets you fetch the detail under the scopes you were granted.

Three rules worth knowing up front

Tenancy comes from the token. There is no buildingId parameter anywhere in /ext/v1. A token minted for one tenant cannot read another, and an id outside your scope returns 404, never 403 — the API never confirms that something you cannot read exists.

You are never more privileged than a person. Scopes mirror capabilities a human manager holds. For user-initiated invocations the token also carries the acting user, and reads are filtered by what that person can see.

Payloads are thin on purpose. An event tells you what changed and gives you ids; the Gateway gives you detail, under a scope check, audited. That split is why an event stream you subscribe to broadly does not become a bulk data export.

API stability

A /ext/v1 surface stays live for a minimum of twelve months from the date its successor is announced. Deprecated endpoints advertise themselves on every response with Deprecation, Sunset, and Link: …; rel="successor-version" headers, and we contact affected publishers directly using call telemetry. Event payloads evolve additively only: a breaking change ships as a new event name, never as a new shape under the old one.

Becoming a partner

Partner enrollment is operator-mediated today. Get in touch through our contact page and we will walk you through domain verification, key registration, the data-processing agreement, and a staging install to build against.