API Overview
The Houzz Pro API gives verified partners programmatic access to the data and workflows that pros use every day — projects, leads, contacts, tasks, scheduling, files, and more.
This page summarizes what the API covers and the conventions shared across every endpoint. For the full, operation-by-operation reference with request/response schemas and a Try It console, use the interactive reference.
Browse every endpoint, inspect schemas, and send live requests from the interactive API reference. It stays in sync with the published OpenAPI specification.
What the API covers
All endpoints are versioned under the /v1 prefix. Resources are grouped as follows:
| Resource group | What it covers |
|---|---|
| Projects | Active home-improvement jobs, plus read-only project statuses and project types. |
| Leads | Pre-project sales opportunities (inquiries), plus read-only lead phases. |
| Milestones | Scheduled timeline items on a project or lead. |
| Tasks & Punchlist | Actionable items on projects, leads, and punchlists. |
| Daily Logs | Timestamped field notes on a project. |
| Files | Documents, images, and folders attached to a company, project, or inquiry. |
| Contacts & Contact Groups | Address-book individuals and the groups they belong to. |
| Vendors | Suppliers of materials, products, and services. |
| Team Members | Internal staff on a pro's account. |
| Subcontractors | External trade professionals, plus read-only subcontractor trades. |
| Entity Assignments | Assignees across projects, leads, tasks, and milestones. |
| Custom Fields | Custom field definitions and values — commonly used to store cross-reference IDs. |
| Webhooks | Subscriptions and the trigger catalog for real-time event delivery. |
Conventions
Base URLs
| Environment | Base URL |
|---|---|
| Production | https://pro-api.houzz.com/api |
Requests and responses
- All requests and responses use JSON (
Content-Type: application/json), except the OAuth token request, which is form-encoded. - Single-resource responses are wrapped as
{ "data": { ... } }. - Delete responses return
{ "deleted": true }.
Authentication
Every request requires an OAuth 2.0 client credentials Bearer token, and each operation declares the scope(s) it needs — where an operation accepts several, any one of them is sufficient. See the Authentication guide for the token flow and Scopes for the full list.
Authorization: Bearer <access_token>
Pagination
List endpoints accept limit (default 20, max 300) and offset query parameters and
return an envelope:
{ "data": [ ... ], "limit": 20, "offset": 0, "total": 123 }
See the Pagination guide for paging patterns.
Rate limits
Requests are limited per company by a token bucket — a 45-request burst refilling at
15 requests/second — and accounts may additionally carry a monthly request allowance.
Both surface as 429. See Rate limits.
Errors
Errors return a consistent envelope with a standard HTTP status code:
{ "error": { "code": "FORBIDDEN", "message": "You do not have permission to perform this action." } }
Branch on the HTTP status and error.code, never on error.message. One response — the
monthly usage-limit 429 — is a known exception whose error is a plain string; see the
Errors guide for status codes and how to handle them.
Webhooks
Rather than polling, subscribe an HTTPS endpoint to (resourceName, eventType) triggers
and receive signed POST deliveries. Delivery is at-least-once with automatic
exponential-backoff retries, so handlers must be idempotent — de-duplicate on the
payload's delivery_id. See the Webhooks guide and
Retries and backoff.
Next steps
- Follow the Examples & Recipes to make your first calls.
- Set up real-time event delivery with the Webhooks guide.
- Open the interactive API reference to explore and test every endpoint.