listings:read permission. Any other key gets 403 forbidden on the list and 404 on a mandate.
The list of mandates
GET /account/mandates returns the company’s mandates, with cursor pagination, oldest first. With status you get only the waiting ones (requested), the confirmed ones (confirmed) or the history (closed: refused, withdrawn, revoked and expired).
GET /account/mandates/{id} returns a single mandate, in the same shape. A mandate the key does not see gets 404, like one that does not exist.
The values of
step:
awaiting_developer: the request waits for the developer’s answer;awaiting_moderation: Housera’s moderation decides the request, for example because the developer is not on Housera or did not answer in time;better_contract_requested: the agency was asked for a better contract;to_declare: a mandate from before, which the agency has to declare;renewal_to_check: the agency sent a renewed contract, which the developer has to check;confirmed: the mandate is confirmed and waits for nothing;ended: the mandate has ended.
Mandate events
When a mandate asks you to take a step, you get an event, on your webhook and inGET /events. They start in the portal, in Housera’s moderation or in the daily check of the deadlines, like the notifications the owner and admins get.
All of them have
mandate_id, complex (code, title, url) and status, the mandate’s status when the event happened, except complex.mandate_restricted, which is about the agency, not a mandate, and has only until. With mandate_id you read the mandate with GET /account/mandates/{id}.
The events reach the company’s owner and admins, through the keys bound to the company with the listings:read permission, and an integrator only if its connection is on that company. A webhook that gets complex.mandate_confirmed gets them too, without ticking them.
complex.mandate_confirmed, complex.mandate_ended and complex.taken_over stay as they were. You find them in Webhooks.