Documentation de l’API Replik

1. Créer une clé API

Dans votre espace Replik, menu Outils → API : nommez la clé, choisissez ses droits, et copiez le secret (affiché une seule fois). Vous devez avoir accepté les conditions générales en vigueur.

2. Obtenir un jeton (OAuth2 client credentials)

curl -X POST https://app.replik.app/api/v1/oauth/token \
  -u "rpk_votre_client_id:rps_votre_secret" \
  -d grant_type=client_credentials

Réponse : access_token (Bearer), valable 1 heure.

3. Appeler l’API

curl https://app.replik.app/api/v1/reviews?unanswered=true \
  -H "Authorization: Bearer rpt_..." -H "Accept-Language: fr"

curl -X POST https://app.replik.app/api/v1/reviews/123/suggestions \
  -H "Authorization: Bearer rpt_..." -H "Idempotency-Key: 6f1c2b7e" \
  -H "Content-Type: application/json" -d '{"tone": 6}'

curl -X POST https://app.replik.app/api/v1/reviews/123/replies \
  -H "Authorization: Bearer rpt_..." -H "Idempotency-Key: 9d4e0a11" \
  -H "Content-Type: application/json" -d '{"suggestion_id": 456}'

Erreurs : objet JSON error avec code, message et details. Limites par clé : 120 lectures, 30 écritures et 20 générations par minute (en-têtes RateLimit-*, code 429). Les POST exigent l’en-tête Idempotency-Key : rejouer la même requête ne débite et ne publie qu’une fois.

Webhooks

Déclarez une adresse HTTPS (page API de votre espace, ou POST /webhooks) : Replik l’appelle à chaque événement choisi. Vérifiez la signature avant de traiter l’appel, et répondez 2xx en moins de 10 secondes ; en cas d’échec, Replik réessaie pendant 24 heures.

Événements : review.created · review.suggestion_ready · reply.published · reply.failed · review.removed · listing.alert · account.access_revoked · enrollment.completed · enrollment.failed · billing.limit_reached · billing.invoice_created

// PHP : vérifier l'en-tête Replik-Signature (t=…,v1=…)
$raw = file_get_contents('php://input');
parse_str(str_replace(',', '&', $_SERVER['HTTP_REPLIK_SIGNATURE']), $sig);
$expected = hash_hmac('sha256', $sig['t'] . '.' . $raw, getenv('REPLIK_WEBHOOK_SECRET'));
if (! hash_equals($expected, $sig['v1']) || abs(time() - (int) $sig['t']) > 300) {
    http_response_code(400); exit;
}
$event = json_decode($raw, true);   // id, type, created_at, account_id, data
// Ignorer un id déjà traité : un même événement peut être livré deux fois.

POST/api/v1/oauth/tokenGet an access token (OAuth2 client credentials)

Paramètre	Où	Type
`grant_type`	body	string : client_credentials
`client_id`	body	string
`client_secret`	body	string
`scope`	body	string

GET/api/v1/accountAccount, Sun balance and terms

GET/api/v1/placesList businesses

Scope places:read.

GET/api/v1/places/{place_id}Get a business

Paramètre	Où	Type
`place_id` *	path	string

PATCH/api/v1/places/{place_id}Update Replik settings of a business

Scope places:write. Only the fields sent are changed. Autopilot requires a plan.

Paramètre	Où	Type
`place_id` *	path	string

GET/api/v1/places/{place_id}/listingGet the Google Business Profile (live)

Paramètre	Où	Type
`place_id` *	path	string

PATCH/api/v1/places/{place_id}/listing/{section}Update a section of the Google Business Profile

Scope places:write. Sections: identity (title, primary_category, additional_categories), description, contact (primary_phone, additional_phones, website), hours (days.{DAY}.mode closed|open24|slots, days.{DAY}.slots[].open/close HH:MM), special_hours (special[].date, closed, open, close), status (OPEN|CLOSED_TEMPORARILY), attributes, lodging, services, menu. Only changed fields are sent to Google.

Paramètre	Où	Type
`place_id` *	path	string
`section` *	path	string : identity \| description \| contact \| hours \| special_hours \| status \| attributes \| lodging \| services \| menu

GET/api/v1/reviewsList reviews with their replies

Scope reviews:read. Newest first, cursor pagination.

Paramètre	Où	Type
`place_id`	query	string
`since`	query	string
`until`	query	string
`rating`	query	integer
`unanswered`	query	boolean
`source`	query	string : google \| tripadvisor \| trustpilot \| appstore \| googleplay
`limit`	query	integer
`cursor`	query	string

GET/api/v1/reviews/{review_id}Get a review with its replies

Paramètre	Où	Type
`review_id` *	path	integer

POST/api/v1/reviews/{review_id}/suggestionsGenerate an AI reply suggestion

Scope reviews:write. Billed as in the app (Sun price or plan quota, free variants included). 402 insufficient_suns if needed.

Paramètre	Où	Type
`review_id` *	path	integer
`Idempotency-Key` *	header	string
`tone`	body	integer
`instructions`	body	string

POST/api/v1/reviews/{review_id}/repliesPublish a reply

Scope reviews:write. Send suggestion_id (optionally with an edited text) or your own text. Google: queued (202), follow /publications/{id}. Connected App Store / Google Play apps: published directly (201). Other platforms: 422 platform_not_publishable.

Paramètre	Où	Type
`review_id` *	path	integer
`Idempotency-Key` *	header	string
`suggestion_id`	body	integer
`text`	body	string

GET/api/v1/publications/{publication_id}Follow a publication

Paramètre	Où	Type
`publication_id` *	path	integer

GET/api/v1/accountsList attached client accounts (partners)

Scope accounts:manage, without Replik-Account header.

DELETE/api/v1/accounts/{account_id}Detach a client account (partners)

Scope accounts:manage. Businesses are suspended and data is deleted after 30 days.

Paramètre	Où	Type
`account_id` *	path	integer

POST/api/v1/enrollmentsEnrol a client (partners)

Scope accounts:manage. Returns a one-time connect_url (valid 7 days) for the client: a Replik page with your name and logo, consent, then Google sign-in. The client is sent back to return_url?enrollment_id=…&status=completed|no_place|not_allowed&external_ref=…, and never gets access to the Replik interface. Webhooks: enrollment.completed, enrollment.failed. return_url must be https on a domain declared in your contract.

Paramètre	Où	Type
`Idempotency-Key` *	header	string
`email`	body	string
`name`	body	string
`locale`	body	string : fr \| en
`return_url`	body	string
`service`	body	string : essential \| pro
`places`	body	string : all \| choose
`external_ref`	body	string

GET/api/v1/enrollments/{enrollment_id}Follow an enrollment (partners)

Paramètre	Où	Type
`enrollment_id` *	path	integer

DELETE/api/v1/enrollments/{enrollment_id}Cancel an unused enrollment link (partners)

Paramètre	Où	Type
`enrollment_id` *	path	integer

GET/api/v1/billingCurrent month usage and invoices (partners)

Active places per plan, overage this month (Suns and € excl. VAT), spending cap, last 24 monthly invoices. Overage actions are refused with 402 once the monthly cap is reached (webhook billing.limit_reached).

GET/api/v1/webhooksList webhook endpoints

Scope webhooks:manage.

POST/api/v1/webhooksCreate a webhook endpoint

Scope webhooks:manage. Public HTTPS URL only. The signing secret is returned once. Events: review.created, review.suggestion_ready, reply.published, reply.failed, review.removed, listing.alert, account.access_revoked, enrollment.completed, enrollment.failed, billing.limit_reached, billing.invoice_created. Each call is a POST with a JSON body {id, type, created_at, account_id, data} (data.review uses the Review schema) and headers Replik-Event, Replik-Delivery (event id, stable across retries) and Replik-Signature: t=<unix time>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" with your secret>. Answer 2xx within 10 seconds. Retries after 1 min, 5 min, 15 min, 1 h, 3 h, 6 h and 12 h; the endpoint is disabled after 50 consecutive failures.

Paramètre	Où	Type
`url`	body	string
`events`	body	array

DELETE/api/v1/webhooks/{webhook_id}Delete a webhook endpoint

Paramètre	Où	Type
`webhook_id` *	path	integer

POST/api/v1/webhooks/{webhook_id}/testSend a ping event

Paramètre	Où	Type
`webhook_id` *	path	integer

GET/api/v1/webhooks/{webhook_id}/deliveriesLast 100 deliveries

Paramètre	Où	Type
`webhook_id` *	path	integer

API Replik v1

1. Créer une clé API

2. Obtenir un jeton (OAuth2 client credentials)

3. Appeler l’API

Webhooks