MotorHangar Inventory API

Quick start

1. In your dealer panel, open API keys and create one. Copy it: it is shown once.
2. Check it works:

curl https://motorhangar.com/api/v1/me \
  -H "Authorization: Bearer mh_your_key"

3. Publish a car with your own stock ID. Sending it again updates it; it never duplicates.

curl -X PUT https://motorhangar.com/api/v1/vehicles/STOCK-001 \
  -H "Authorization: Bearer mh_your_key" \
  -H "Content-Type: application/json" \
  -d '{"brand": "Toyota", "model": "RAV4", "year": 2019, "version": "XLE AWD",
       "price": 18500, "mileage": 45000, "fuel": "petrol", "transmission": "automatic",
       "photos": ["https://example.com/1.jpg", "https://example.com/2.jpg", "https://example.com/3.jpg"]}'

The answer is 201 the first time and 200 afterwards. The car shows as importing_photos while we download the photos, then active.

Authentication

Send the key in a header, Authorization: Bearer mh_… or X-API-Key: mh_…. Never in the URL: URLs end up in server logs. We only store a hash of your key, so if you lose it, revoke it and create another. A key belongs to one dealership and can only see and change that dealership's cars.

If your account sells in more than one market, say which one with market (in the body or the query string). GET /markets/{code} tells you what that market accepts: currencies, fuels and whether mileage goes in km or miles.

The vehicle

The rules are the same as publishing by hand or by spreadsheet: brand and model must exist in our catalog (we never invent models), and every car needs 3 to 10 photos.

Status values: active, in_review, importing_photos, sold, expired, withdrawn. Sources: api, woocommerce, wordpress, shopify, prestashop, odoo, tiendanube, n8n, zapier, make, feed.

Endpoints

Base URL: https://motorhangar.com/api/v1

• Vehicles
• GET /vehicles List your vehicles Newest updates first. Use updated_since to poll for changes.
• GET /vehicles/{external_id} Get one vehicle
• PUT /vehicles/{external_id} Create or update a vehicle Idempotent: sending the same stock ID again updates the car instead of duplicating it. A sold car sent again is back for sale.
• DELETE /vehicles/{external_id} Withdraw a vehicle It stops being published. Nothing is deleted: its page keeps answering, as a sold car's does.
• POST /vehicles/{external_id}/sold Mark a vehicle as sold
• Sync
• POST /vehicles/sync Create or update up to 500 vehicles in one call Each vehicle is validated and applied on its own: one bad car never blocks the rest. For more than 500 cars, send several calls without mark_missing_as_sold and finish with POST /vehicles/reconcile.
• POST /vehicles/reconcile Mark as sold the cars of a source that are no longer in your stock Send every stock ID of the source that is still for sale. The others of that source are marked as sold. Guard: if that would mark more than 40% of the source's cars at once (and at least 5), nothing is marked and you get 409 — usually a partial export. An empty list is always refused.
• POST /feeds/{token}/ Push your whole inventory file (for providers) For your website company, DMS or inventory provider: POST the WHOLE inventory file (CSV, Excel, JSON or XML, up to 10 MB) to the private address shown in the dealer panel (Inventory feed → My provider will send it). No API key: the token in the address is the secret. Same rules as /vehicles/sync, including the sold guard.
• Catalog
• GET /markets/{code} What a market accepts: currencies, fuels, mileage unit
• GET /catalog/brands Brands in the catalog
• GET /catalog/brands/{slug}/models Models and years of a brand
• Leads
• GET /leads Buyers who wrote about your cars Newest first, up to 100. Use since to poll. The buyer's contact details are not included: they are shared in the conversation when the buyer chooses to.
• Webhooks
• GET /webhooks Your webhooks and the events you can subscribe to
• POST /webhooks Subscribe a URL to events For n8n, Make or Zapier triggers that register themselves. Up to 20 per account.
• GET /webhooks/{id} One webhook
• DELETE /webhooks/{id} Unsubscribe
• Account
• GET /me Your dealership, markets and limits

Syncing a whole stock

Each car carries a source (woocommerce, shopify, api…). Marking missing cars as sold only ever touches cars of the same source, so a store plugin never marks as sold the cars you uploaded by spreadsheet.

• Up to 500 cars: one POST /vehicles/sync with "mark_missing_as_sold": true.
• More than 500: several POST /vehicles/sync calls without it, then one POST /vehicles/reconcile with every stock ID that is still for sale.

One bad car never blocks the rest: you get 207 and an errors list, and nothing is marked as sold in that call. Two guards protect you from a broken export: an empty list is never "everything was sold", and if more than 40% of a source's cars (and at least 5) would be marked as sold at once, nothing is marked and you get 409. Send "allow_mass_sold": true when it is real.

Webhooks

Instead of polling, let us call you. Add a URL in your dealer panel (Webhooks) or with POST /webhooks, which is what n8n, Make or Zapier triggers use to register themselves. Events:

• lead.created — a buyer wrote to you about one of your cars (the conversation link, not their contact details).
• vehicle.sold — one of your cars became sold, from any channel.
• vehicle.rejected — a car you sent by API or feed failed validation; errors says why.
• sync.failed — a feed could not be read, or we refused to mark many cars as sold at once.

Every delivery is a POST with this body, and the headers X-MotorHangar-Event, X-MotorHangar-Delivery (the event id: use it to ignore repeats) and X-MotorHangar-Signature.

{"id": "8b1c…", "type": "vehicle.sold", "created_at": "2026-10-15T14:02:11+00:00",
 "data": {"external_id": "STOCK-001", "listing_id": "MH7K2Q", "market": "pe", "source": "feed",
          "vehicle": "Toyota RAV4 2019", "url": "https://motorhangar.com/pe/car/…"}}

The signature is t=<unix time>,v1=<hex>, where v1 is the HMAC-SHA256 of "<t>.<raw body>" with your signing secret. Reject it if it doesn't match or if t is more than 5 minutes old.

import hmac, hashlib, time

def valid(secret, body: bytes, header: str) -> bool:
    parts = dict(p.split("=", 1) for p in header.split(","))
    t = int(parts["t"])
    mac = hmac.new(secret.encode(), f"{t}.".encode() + body, hashlib.sha256).hexdigest()
    return abs(time.time() - t) < 300 and hmac.compare_digest(mac, parts["v1"])

Answer with any 2xx within 10 seconds. Timeouts, 5xx and 429 are retried after 1, 5, 30, 120 and 360 minutes; other 4xx are not. A webhook that fails 20 deliveries in a row is turned off (you can turn it back on by sending a test from the panel). Buyers' contact details are never included.

Inventory feeds

No code at all: in Inventory feed give us the address of a CSV, Excel, JSON or XML file, or a Google Sheet, that your website, DMS or provider already produces. We show you the columns we found and how the first cars would look, you confirm, and we read it every few hours. If a provider sends your stock to other portals (HomeNet and similar), ask them to add MotorHangar as a destination and give them the private push address from that page.

Errors and limits

Errors always look like {"error": {"code": "…", "message": "…"}}. A 422 adds fields with each broken rule, written to be shown to a person.

• 401 missing or revoked key · 404 no such car · 409 refused by the sold guard · 413 too many cars in one call · 422 the car breaks a rule.
• 429: more than 120 calls a minute per key. Wait the seconds in Retry-After.
• Retry 429 and 5xx. Don't retry other 4xx: the same request will fail the same way.

Plugins and no-code tools

Each one has its own page with the full setup, what syncs and its limits. All integrations, with what is available, in beta and planned.

Code samples

PHP

$ch = curl_init('https://motorhangar.com/api/v1/vehicles/' . rawurlencode($stockId));
curl_setopt_array($ch, [
    CURLOPT_CUSTOMREQUEST  => 'PUT',
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $key, 'Content-Type: application/json'],
    CURLOPT_POSTFIELDS     => json_encode($car),
    CURLOPT_RETURNTRANSFER => true,
]);
$response = json_decode(curl_exec($ch), true);
$status = curl_getinfo($ch, CURLINFO_HTTP_CODE); // 200, 201 or 422

Python

import requests

s = requests.Session()
s.headers["Authorization"] = f"Bearer {key}"
r = s.post("https://motorhangar.com/api/v1/vehicles/sync", json={"source": "api", "mark_missing_as_sold": True, "vehicles": cars})
for e in r.json()["errors"]:
    print(e["external_id"], e["message"])

JavaScript

const r = await fetch(`https://motorhangar.com/api/v1/leads?since=${encodeURIComponent(lastCheck)}`, {
  headers: { Authorization: `Bearer ${key}` },
});
const { data } = await r.json();