Authentication

Lead import and other public API calls use Bearer token authentication. Each integrator is typically issued one API key.

Obtain an API key

Email support@dealerstudio.com.au to request a key. Keys can be scoped to specific dealerships and configured with permissions and optional IP allowlisting.

Send the token

Include the API key on every request:

Authorization: Bearer YOUR_API_KEY

Use HTTPS only. The production base URL is:

https://dashboard.dealerstudio.com.au

Create and update leads

Action	Method	Path	Permission required (if key is restricted)
Create lead	POST	/api/v1/leads	create:lead
Update lead	PUT	/api/v1/leads/{id}	update:lead

If the key’s permission list is empty, all allowed actions for that key are permitted (still subject to dealership scope on the key).

See the Create Lead and Update Lead reference for request bodies and response codes.

IP allowlisting

If IP addresses are configured on your API key, requests must originate from one of those addresses. Requests from other IPs are rejected with 401 Unauthorized.

If no IPs are configured, IP allowlisting does not apply.

Common responses

Status	Meaning
401 Unauthorized	Authentication failed — see the error field in the JSON body

401 error bodies

Failed authentication returns JSON:

{ "error": "<message>" }

error	Meaning
Missing API key	No Authorization: Bearer … header (or equivalent Token credential) was sent
Invalid API key	The bearer token was not recognised
API key not allowed from this IP address	The key has an IP allowlist and this request’s IP is not on it
API key lacks required permission	The key is valid but does not include the permission for this action (e.g. create:lead)
API key not authorised for this dealership	The key is valid but is not scoped to the dealership in the request. An unknown dealership_id, dealership_slug, or dealer_code returns this same error

Related guides

• Getting started — platform overview and security practices
• Stellantis lead import — example payload for POST /api/v1/leads