A read-only API over everything you manage.
Seven resources, JSON, bearer keys, and a shape that will not move under you. Ask for a key and tell us what you are building — we answer within two working days.
Seven endpoints, all GET.
Everything is paged with limit and offset, returns { data, limit, offset }, and gives money in dollars rather than cents.
| Endpoint | Returns |
|---|---|
| GET /v1/properties | Every property, with its unit count. |
| GET /v1/units | Units, their property, and current occupancy. |
| GET /v1/residents | The people on your leases. |
| GET /v1/leases | Terms, rent, deposit and status. |
| GET /v1/ledger | Charges, payments, fees and credits per unit. |
| GET /v1/maintenance | Work orders from request to resolved. |
| GET /v1/listings | Published adverts and their enquiries. |
curl https://api.villagely.io/v1/units?limit=50 \
-H "Authorization: Bearer vly_live_..."
{
"data": [
{ "id": "…", "label": "2B", "propertyId": "…", "occupied": true }
],
"limit": 50,
"offset": 0
}The parts worth knowing before you build.
Bearer keys, made in your dashboard
Create a key under API Keys, send it as Authorization: Bearer. Keys are org-scoped and can be revoked from the same screen.
One tenant, always
Every handler scopes to the key's organisation. Nothing accepts an organisation id from the caller, so a key cannot reach another tenant's data.
120 requests a minute, per key
Counted per key rather than per IP, so several customers behind one network never exhaust each other's budget. Standard rate-limit headers come back on every response.
v1 is frozen in shape
Fields get added, never removed or retyped. When a shape has to change it becomes v2 and v1 keeps working.
What this API cannot do.
Listed because finding out halfway through a build is worse than reading it here.
No writes.
Everything is GET. Tell us what you need to create or update and we will design that around a real use, not a guess.
No webhooks.
You poll. If polling is wrong for what you are doing, say so in your application — that is the argument that gets webhooks built.
No sandbox.
Keys are issued against your own organisation and your own data. Which is part of why access is by application.
No SDKs.
It is JSON over HTTPS with a bearer token. Anything that speaks HTTP already speaks this.
Why you have to ask.
Not scarcity. There is no sandbox, no per-tier rate limit and no deprecation policy yet, and the first integration to ship in anger freezes every response shape we have.
A small group we can talk to is worth more than an open door we cannot support. So we read each application, and we answer it — within two working days, with credentials and the endpoint reference, or with an honest reason why not yet.
Already a customer with a key? Everything above works today. Manage keys under API Keys in your dashboard.