Build integrations on Biz Review Radar

Overview

The Biz Review Radar (BRR) platform exposes a stable REST + JSON API, signed outbound webhooks, OAuth 2.0, and a private Zapier integration. The full API reference, the OpenAPI 3.1 specification, and the management UIs live inside the authenticated Developer Portal. This page is a public overview — no secrets or internal admin details are exposed.

Getting started

1. Create an account at /auth and complete onboarding for your business.
2. Request developer access. Eligible plans (or the api_demo entitlement) unlock the Developer Dashboard at /dashboard/developers.
3. Issue an API key — a test key with the prefix brr_test_. Copy the raw value once at creation; only a hash is stored.
4. Call the API. Base URL: https://bizreviewradar.com/api/v1.

curl https://bizreviewradar.com/api/v1/businesses \
  -H "Authorization: Bearer YOUR_API_KEY"

Full request/response examples for every endpoint are in the public API reference and the authenticated portal.

Authentication

Every request is authenticated. Three methods are supported and can be mixed per account:

• API keys — long-lived, sent as Authorization: Bearer <key> or X-API-Key.
• OAuth 2.0 client credentials — exchange a client id + secret at POST /api/oauth/token for a short-lived HS256 JWT. Best for server-to-server.
• OAuth 2.0 authorization code + PKCE — for approved third-party apps acting on behalf of a user. Implemented and gated behind an admin feature flag; not open to the public yet.

curl -X POST https://bizreviewradar.com/api/oauth/token \
  -H "Content-Type: application/json" \
  -d '{"grant_type":"client_credentials","client_id":"...","client_secret":"..."}'

Scopes, token lifetimes, and per-endpoint permissions are detailed in the OAuth guide.

API keys

• Prefix brr_test_ — issued to any eligible developer for testing against your own account's data.
• Prefix brr_live_ — enabled only when the platform-wide live_keys_enabled flag is on and issued by an admin. Live keys are business-bound and enforce full quotas.
• Keys are stored as a secure hash. The raw secret is displayed exactly once at issuance — store it in your secret manager immediately.
• Revoke a key at any time in /dashboard/developers. Revocation is immediate and returns 401 invalid_api_key.
• Rate limits are enforced per key and per IP; see the API reference for current limits per endpoint class.

Webhooks

Subscribe an HTTPS endpoint to receive events. Deliveries are signed with HMAC-SHA256 using your endpoint's secret; retries follow exponential backoff.

• analysis.completed — a competitor / business analysis finished.
• analysis.failed — an analysis failed after retries.
• report.generated — a downloadable report is ready.
• recommendation.created — a new prioritized recommendation was produced.

Signature header: X-BRR-Signature: sha256=<hex> over the raw request body. Full verification code, retry schedule, and payload examples are in the webhook guide.

API reference

Public overview and example requests: /developers/api-reference. The full OpenAPI 3.1 specification, endpoint-by-endpoint reference, and interactive try-it console are available after sign-in at /app/developers.

Base URL today: https://bizreviewradar.com/api/v1. A dedicated host (api.bizreviewradar.com) is planned; the current base URL will continue to work through the transition.

OAuth guide

Two OAuth flows are supported:

• Client credentials — machine-to-machine. POST /api/oauth/token with grant_type=client_credentials returns a short-lived JWT.
• Authorization code + PKCE (S256) — foundation is implemented for future public partners. Currently disabled at runtime behind oauth_authcode_enabled.

Detailed flow diagrams, scopes, and examples: /developers/oauth.

Zapier private integration Ready for private demo

The Zapier app is private and available to approved accounts only. It supports triggers (new analysis, new recommendation, webhook forwards), actions (create business, draft reply), and dynamic dropdowns backed by your business list.

• Authentication: brr_test_ API keys during private demo. Live keys are enabled only when the platform flag is on.
• Signature verification on Zapier-bound webhooks is fail-closed.
• Public marketplace submission is intentionally paused pending DNS, live-key rollout, and legal sign-off.

To request access, contact sales@bizreviewradar.com.

ChatGPT / MCP Private foundation ready

An internal Model Context Protocol (MCP) server is implemented at /api/public/mcp and gated behind a feature flag. It exposes a small, read-oriented tool surface (business summaries, recommendations, review context) for approved ChatGPT/MCP clients.

• Status: private foundation, not open to the public.
• No public OpenAI app has been published; the OpenAI-related backend features power in-app AI (reply drafting, analysis) using server-side, encrypted credentials.

Interested partners should contact sales@bizreviewradar.com for evaluation access.

Google Business Profile / GMBapi Coming soon — disabled pending approval

The Google Business Profile (GBP) integration is code-complete and disabled behind a feature flag pending Google API approval and owner DNS configuration. When enabled it will:

• List the customer's own Google accounts and locations after explicit OAuth consent.
• Sync owned reviews and surface them alongside BRR analysis.
• Publish human-approved AI reply drafts — BRR never auto-publishes to Google.
• Send controlled profile-update requests through an HMAC-validated pipeline.

OAuth tokens are stored encrypted at rest (AES-256-GCM). See Learn more and the Google user-data section of the Privacy Policy.

GMBapi and equivalent third-party GBP gateways are on the evaluation list; no live integration is launched yet.

Integration status

Make, n8n and Pabbly can be connected today through the REST API and webhooks; no dedicated app is published yet.

Changelog

Breaking changes to stable endpoints are announced at least 30 days in advance. Read the public log: /developers/changelog.html.

Support

• General & sales: sales@bizreviewradar.com
• Product help: hello@bizreviewradar.com
• Security disclosures: sales@bizreviewradar.com (mark subject "Security disclosure")
• Status & incidents: announced in the changelog and by email to registered developer accounts.

Policies

• Privacy Policy
• Terms of Service
• Google user-data usage & deletion policy