REST

https://api.duor.io/v1, bearer auth with a secret key:

curl https://api.duor.io/v1/partner/configurations/kX3f9a \
  -H "Authorization: Bearer sk_live_…"

Only the endpoints partners actually use are published. Internal routes are not documented, and that is a promise rather than an omission: a documented route is one we cannot change without breaking somebody.

GET /v1/partner/configurations/:shortId

The authoritative price. The widget computes one so the number can move while somebody drags a door; this is the one an invoice may use. Same engine, run on our side, on inputs a browser cannot edit.

{
  "shortId": "kX3f9a",
  "createdAt": "2026-08-29T11:02:19Z",
  "currency": "EUR",
  "priceCents": 432000,
  "sizeMm": [3460, 2700, 2400],
  "lines": [
    { "sku": "CAB-600", "quantity": 4, "unitPriceCents": 17300, "totalCents": 69200,
      "materials": { "front": "oak_natural" } }
  ],
  "warnings": []
}

warnings is worth reading. A configuration can be priced and still not be buildable — a piece standing in a doorway, two pieces in the same space — and the codes say which.

GET /v1/partner/leads?since=

{
  "results": [
    { "id": 1042, "createdAt": "2026-08-29T11:02:19Z", "name": "Anna K.",
      "phone": "+371…", "shortId": "kX3f9a", "priceCents": 432000, "currency": "EUR",
      "domain": "duor-shop.lv" }
  ],
  "next": "2026-08-29T11:02:19Z"
}

Polling is the fallback. Webhooks are the way to hear about a request in the second it happens, which is the only second that matters when somebody has just left a phone number.

GET /v1/partner/usage

Sessions, requests and storage against your plan’s allowance, for the month so far. The same numbers the cabinet shows.

POST /v1/partner/price — optional

Only if you have told the widget to use priceRequest. We call you with a bill of materials; you answer { "cents": 432000, "currency": "EUR" }.

Limits

Rate	600 requests a minute per key, 60 on a test key
Page size	100, cursor in next
Timeout	10s; a priceRequest of yours gets 3s before we fall back to ours

429 carries Retry-After. Please read it — retrying immediately is how a rate limit becomes an outage.