EstateReels API

{
  "template": "BasicEditorial",
  "listing": {
    "title": "Upgraded 2BR | Marina View | Vacant",
    "purpose": "sale",
    "price_aed_fils": 245000000,
    "property_type": "apartment",
    "furnishing": "unfurnished",
    "bedrooms": 2,
    "bathrooms": 3,
    "bua_sqft": 1320,
    "community": "Dubai Marina",
    "tower": "Marina Gate 1",
    "city": "Dubai",
    "permit_number": "7112345678",
    "images": [
      "https://cdn.example.com/listings/8841/1.jpg",
      "https://cdn.example.com/listings/8841/2.jpg"
    ]
  },
  "audience_persona": "investor",
  "power_ups": ["enhance_photos"],
  "branding": {
    "agent_name": "Sara Khan",
    "agent_title": "Senior Consultant",
    "agent_phone": "+971500000000",
    "agent_whatsapp": "+971500000000",
    "agency_name": "Example Realty"
  },
  "external_ref": "crm-listing-8841",
  "metadata": { "crm_user_id": "u_193" }
}

# 1. List the templates your key can use
curl https://estatereels.ae/api/v1/templates \
  -H "Authorization: Bearer $ER_API_KEY"

# 2. Price an order without creating it
curl https://estatereels.ae/api/v1/render_quotes \
  -H "Authorization: Bearer $ER_API_KEY" \
  -H "Content-Type: application/json" \
  -d @render.json

# 3. Create the render (Idempotency-Key is required)
curl https://estatereels.ae/api/v1/renders \
  -H "Authorization: Bearer $ER_API_KEY" \
  -H "Idempotency-Key: crm-listing-8841-v1" \
  -H "Content-Type: application/json" \
  -d @render.json

# 4. Poll it, or wait for the render.succeeded webhook
curl https://estatereels.ae/api/v1/renders/RENDER_ID \
  -H "Authorization: Bearer $ER_API_KEY"

{
  "id": "0192f3c1-7d5e-7a3b-9c1d-2f4a6b8c0d1e",
  "object": "render",
  "order_number": 48213,
  "livemode": true,
  "template": "BasicEditorial",
  "status": "succeeded",
  "stage": null,
  "credits_charged": 2,
  "external_ref": "crm-listing-8841",
  "metadata": { "crm_user_id": "u_193" },
  "created_at": "2026-10-02T09:14:03.000Z",
  "completed_at": "2026-10-02T09:19:47.000Z",
  "output": {
    "video_url": "https://...signed...",
    "thumbnail_url": "https://...signed...",
    "urls_expire_at": "2026-10-02T10:19:50.000Z",
    "duration_seconds": 31.2,
    "file_size_bytes": 38211904,
    "width": 1080,
    "height": 1920,
    "share_url": null
  },
  "error": null,
  "refund": null
}

{
  "id": "evt_0192f3c97d5e7a3b9c1d2f4a6b8c0d1e",
  "object": "event",
  "type": "render.succeeded",
  "api_version": "2026-10-01",
  "created_at": "2026-10-02T09:19:48.000Z",
  "livemode": true,
  "data": { "object": { "id": "0192f3c1-...", "object": "render", "status": "succeeded", "...": "the full render object" } }
}

EstateReels-Signature: t=1759396788,v1=5257a869e7ecebeda32affa62cdca3fa51cad7e77a0e56ff536d0ce8e108d8bd
EstateReels-Event-Id: evt_0192f3c97d5e7a3b9c1d2f4a6b8c0d1e
EstateReels-Delivery-Attempt: 1
User-Agent: EstateReels-Webhooks/1

const crypto = require("crypto");

const TOLERANCE_SECONDS = 300;

// rawBody must be the exact bytes EstateReels sent (a Buffer or string), NOT
// the result of JSON.parse and JSON.stringify. header is the value of the
// EstateReels-Signature header. secret is your endpoint secret (ersec_...).
function verifyEstateReelsSignature(rawBody, header, secret) {
  if (!header) return false;
  let t = null;
  const signatures = [];
  for (const part of header.split(",")) {
    const i = part.indexOf("=");
    if (i < 0) continue;
    const key = part.slice(0, i).trim();
    const value = part.slice(i + 1).trim();
    if (key === "t" && /^[0-9]+$/.test(value)) t = Number(value);
    else if (key === "v1" && /^[0-9a-f]{64}$/.test(value)) signatures.push(value);
  }
  if (t === null || signatures.length === 0) return false;
  if (Math.abs(Math.floor(Date.now() / 1000) - t) > TOLERANCE_SECONDS) return false;

  const expected = crypto
    .createHmac("sha256", secret)
    .update(t + ".")
    .update(rawBody)
    .digest("hex");
  const expectedBuf = Buffer.from(expected, "utf8");
  return signatures.some((sig) => {
    const sigBuf = Buffer.from(sig, "utf8");
    return sigBuf.length === expectedBuf.length && crypto.timingSafeEqual(sigBuf, expectedBuf);
  });
}

module.exports = { verifyEstateReelsSignature };

const express = require("express");
const { verifyEstateReelsSignature } = require("./verify");

const app = express();
const seen = new Set(); // use a database or Redis in production

// express.raw keeps the body as bytes. Do not put express.json() in front of this route.
app.post("/hooks/estatereels", express.raw({ type: "application/json" }), (req, res) => {
  const ok = verifyEstateReelsSignature(
    req.body,
    req.get("EstateReels-Signature"),
    process.env.ER_WEBHOOK_SECRET
  );
  if (!ok) return res.sendStatus(400);

  const eventId = req.get("EstateReels-Event-Id");
  if (seen.has(eventId)) return res.sendStatus(200); // already handled
  seen.add(eventId);

  const event = JSON.parse(req.body.toString("utf8"));
  if (event.type === "render.succeeded") {
    // copy event.data.object.output.video_url into your own storage
  }
  res.sendStatus(200);
});

import hashlib
import hmac
import re
import time

TOLERANCE_SECONDS = 300


def verify_estatereels_signature(raw_body: bytes, header: str, secret: str) -> bool:
    """raw_body: the exact bytes received. header: EstateReels-Signature. secret: ersec_..."""
    if not header:
        return False
    t = None
    signatures = []
    for part in header.split(","):
        key, sep, value = part.partition("=")
        if not sep:
            continue
        key, value = key.strip(), value.strip()
        if key == "t" and re.fullmatch(r"[0-9]+", value):
            t = int(value)
        elif key == "v1" and re.fullmatch(r"[0-9a-f]{64}", value):
            signatures.append(value)
    if t is None or not signatures:
        return False
    if abs(int(time.time()) - t) > TOLERANCE_SECONDS:
        return False

    expected = hmac.new(
        secret.encode("utf-8"), f"{t}.".encode("utf-8") + raw_body, hashlib.sha256
    ).hexdigest()
    return any(hmac.compare_digest(sig, expected) for sig in signatures)

from flask import Flask, request, abort
from verify import verify_estatereels_signature
import json, os

app = Flask(__name__)
seen = set()  # use a database or Redis in production


@app.post("/hooks/estatereels")
def estatereels_hook():
    raw = request.get_data()  # raw bytes, before any JSON parsing
    if not verify_estatereels_signature(
        raw, request.headers.get("EstateReels-Signature", ""), os.environ["ER_WEBHOOK_SECRET"]
    ):
        abort(400)

    event_id = request.headers.get("EstateReels-Event-Id")
    if event_id in seen:
        return "", 200  # already handled
    seen.add(event_id)

    event = json.loads(raw)
    if event["type"] == "render.succeeded":
        pass  # copy event["data"]["object"]["output"]["video_url"] into your storage
    return "", 200

{
  "error": {
    "type": "invalid_request_error",
    "code": "invalid_request",
    "message": "Invalid value for listing.images: Array must contain at least 1 element(s)",
    "param": "listing.images"
  }
}