API and CRM integrations

Send your pipeline, tracked companies, quote requests, bids, bookings and contractor compliance into the CRM you already use, or pull them from your own systems.

REST API

JSON over HTTPS with an OpenAPI description: read and update your own records from any CRM or system.

Signed webhooks

Events the moment something changes, signed so your receiver can trust them.

Spreadsheet imports

Federal pipeline and tracked-company downloads in Salesforce, HubSpot, Unanet and Deltek import layouts.

Get access

API access is part of Enterprise plans and AVCleared Federal. An owner or admin creates a key in Settings (LevelRated: Settings > API and webhooks; AVCleared Federal: Federal > Integrations). Send it on every request:

curl https://levelrated.com/api/v1/me \
  -H "Authorization: Bearer lr_live_..."

Version 2026-11-10. 120 requests a minute per key. Lists return { data, has_more, next_cursor }; pass cursor for the next page, order=asc with updated_since for incremental sync. Full description: openapi.json.

Endpoints

Method	Path	What it does	For	Scope
get	/api/v1/me	The organization this key belongs to	All	read
get	/api/v1/pursuits	List pipeline records	Federal	read
post	/api/v1/pursuits	Add a pipeline record	Federal	write
get	/api/v1/pursuits/{id}	Get a pipeline record	Federal	read
patch	/api/v1/pursuits/{id}	Update a pipeline record	Federal	write
get	/api/v1/tracked-companies	List tracked companies	Federal	read
post	/api/v1/tracked-companies	Track a company by UEI	Federal	write
get	/api/v1/tracked-companies/{id}	Get a tracked company	Federal	read
patch	/api/v1/tracked-companies/{id}	Change tags or note	Federal	write
delete	/api/v1/tracked-companies/{id}	Stop tracking	Federal	write
get	/api/v1/tracked-company-changes	News on tracked companies	Federal	read
get	/api/v1/network	Contractors in your network	Companies	read
get	/api/v1/rfqs	Your RFQs	Companies	read
get	/api/v1/bookings	Your on-demand tech bookings	Companies	read
get	/api/v1/quote-requests	Confirmed quote requests to you	Contractors	read
get	/api/v1/webhooks	List webhook endpoints	All	read
post	/api/v1/webhooks	Subscribe a webhook endpoint	All	write
delete	/api/v1/webhooks/{id}	Unsubscribe a webhook endpoint	All	write

Webhooks

Add an HTTPS endpoint in Settings or with POST /api/v1/webhooks. Each event is a POST of { id, type, created, api_version, data }, where data has the same shape as the API. Any 2xx answer acknowledges it; otherwise we retry for about two hours, and turn the endpoint off after 20 failures in a row. Answer 410 to unsubscribe.

pursuit.created
A pursuit was added to the AVCleared Federal pipeline.
pursuit.updated
Stage, outcome, title, due date, value or owner changed.
tracked_company.added
A company (by UEI) was added to tracked companies.
tracked_company.changed
New award, contract ending, win, joined AVCleared, or contract value change.
quote_request.received
A buyer confirmed a quote request from your public profile.
bid.received
A contractor submitted or updated a bid on one of your RFQs.
rfq.awarded
You awarded an RFQ; the winning contractor and amount are included.
booking.updated
A tech accepted, checked in, finished, or the booking was approved, disputed or cancelled.
network.alert
The same alerts that go to Slack or Teams: license, sanctions, insurance, citation, incident, audit.

Every delivery carries LevelRated-Signature: t=…,v1=…, an HMAC-SHA256 of t + "." + body with your endpoint's secret:

// Node.js: verify a LevelRated webhook
const crypto = require("crypto");
function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  if (Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const want = crypto.createHmac("sha256", secret).update(t + "." + rawBody).digest("hex");
  return crypto.timingSafeEqual(Buffer.from(want), Buffer.from(v1));
}

Data rules

A key only ever sees its own organization's records.
Contact details our staff found for unclaimed profiles never leave the site.
Quote requests appear only after the buyer confirms them by email.
Revoke a key or delete an endpoint in Settings and it stops at once.