Your software runs the workflow — ESXPress turns insurance scope PDFs into Xactimate ESX files. A real REST API, real webhooks, and real numbers: every endpoint and limit on this page is verified against the code, not a roadmap.
Four building blocks, all live in the ESXPress backend today — verified in app/api/v1/.
4 endpoints · API-key auth
Upload one or more scope PDFs (up to 100 per request), poll the conversion, download the validated ESX file, or fetch the original PDF back. Auth is a simple X-API-Key header or Bearer token.
conversion.completed · HMAC-signed
When a conversion finishes, ESXPress POSTs the result to your HTTPS endpoint. Up to 3 delivery attempts (5s / 15s / 45s backoff), an optional HMAC signature to verify the payload, and a delivery log you can replay.
Create · list · revoke
Keys are scoped to one account, revocable any time, and shown in full exactly once. Up to 10 active keys per account. Included with the Enterprise plan — or the $49/mo API & Integrations add-on on Starter and Professional.
Public · no key required
The API reference lives at /api/v1/docs — a styled page with every endpoint, request shape, and error code. You can read it before you sign up.
Three patterns software vendors actually wire up — each one mapped to real endpoints.
Send a whole job's scope PDFs in one request — up to 100 files. Each valid file is queued immediately and returns its own conversion ID; invalid files are reported in an errors list without aborting the batch.
Push the scope PDF with an optional carrier hint, then read back the extracted claim number, insured name, property address, and carrier from the status endpoint — the fields your workflow needs to file the job.
The status response carries every line item with its replacement cost (rcv), depreciation (dep), and ACV, plus totals — so your software can show or export the numbers before the ESX file is even downloaded.
Every number below is read from the code — including the things we don't have yet.
Rate limit
60 requests / minute / API key
Sliding window per key, Redis-backed. Over the limit returns HTTP 429.
File size
50 MB max per PDF
Checked before the file is buffered — oversized uploads are rejected with 413.
Batch size
100 PDFs max per request
More than 100 files returns 413. Partial batches are allowed: valid files queue, invalid ones land in errors[].
API keys per account
10 active keys
Full key shown exactly once, SHA-256 hashed at rest, revocable any time. At the cap, creating another returns 409.
Monthly conversion quota
Starter 25 · Professional 75 · Enterprise 200 · Volume+ unlimited
Quota is reserved per file at queue time — at the cap the API returns 402 with your used/limit before anything is queued.
Access
Enterprise plan, or the $49/mo API & Integrations add-on
API keys and webhooks are gated behind the enterprise tier; the add-on unlocks both on Starter and Professional. Enterprise and Volume include them.
Webhook targets
HTTPS only, SSRF-guarded
Payloads contain claim PII, so cleartext http:// is rejected and internal/private addresses are blocked.
Webhook delivery
3 attempts · 5s / 15s / 45s backoff
Optional HMAC signature (X-Webhook-Signature) plus event headers so receivers can verify who sent the payload.
Docs
/api/v1/docs is public
No API key needed to read the reference. The raw OpenAPI schema is restricted to admin accounts — the docs page is the public contract.
Sandbox
None yet — and we're upfront about it
There is no separate sandbox environment in the codebase today. You develop against the same API: create a key, test with sample PDFs (we ship free /demo-files), and revoke the key when you're done.
Upload, poll, download — that's the whole flow. The same contract works from Python, Node, or any HTTP client.
Upload → status → download (curl)
# 1 · Upload a scope PDF (batch up to 100; 50MB each) curl -X POST https://esxpress.org/api/v1/public/convert/upload \ -H "X-API-Key: esx_xx...xxx" \ -F "[email protected]" \ -F "carrier=StateFarm" # → { "ok": true, "jobs": [{ "filename": "scope.pdf", "conversion_id": 42 }] } # 2 · Poll until status is "ready" curl -H "X-API-Key: esx_xx...xxx" \ https://esxpress.org/api/v1/public/convert/42/status # 3 · Download the validated ESX file curl -OJ -H "X-API-Key: esx_xx...xxx" \ https://esxpress.org/api/v1/public/convert/42/download
Errors: 401 missing / invalid / revoked key · 400 not a PDF or too large · 402 plan quota reached (includes used/limit) · 404 conversion not found · 429 rate limit (60 req/min/key). Full reference: /api/v1/docs.
Software vendors: we'd rather answer questions than have you guess. Talk to us before you write the first request.