Panda IDX API — Getting Started

The Panda IDX API provides programmatic access to MLS listings, contacts, visitor analytics, and market data. Use it to build integrations, automate workflows, or power your own applications. Machine-readable spec: /openapi.json. Developer hub: /developers.

Base URLs

APIhttps://api.pandaidx.com

Production

Authhttps://login.pandaidx.com

OAuth 2.0

Sandboxhttps://www.pandaidx.com/api/v1/status

Mock data

Public sandbox

Agents and developers can call the public sandbox without an API key. It returns mock RESO listings, contacts, and analytics that match the production schemas. Production data still requires OAuth or a personal API key.

Request

curl --request GET \
  --url "https://www.pandaidx.com/api/v1/listings?City=Miami&Limit=5"

Authentication

The Panda IDX API uses Bearer token authentication. There are two ways to get a token depending on your use case.

Personal API Key

For accessing your own data. Generate a key from your dashboard. Requires a Signature subscription.

Authorization: Bearer {{YOUR_API_KEY}}

OAuth 2.0 Token

For Partners

For apps that access other users' data. The user authorizes your app via OAuth, and you receive an access token.

Authorization: Bearer {{ACCESS_TOKEN}}

Scopes & roles

Panda IDX uses least-privilege OAuth scopes and matching API key roles. Request only the access your integration needs. There is no admin or wildcard scope.

Scope / role	Grants	Endpoints
listings	Read MLS search, listing detail, and change feed	/v1/listings*
contacts	Read CRM contacts and activity	/v1/contacts*
analytics	Read website analytics	/v1/analytics

Personal API keys can be minted as listings, contacts, analytics, or all. A listings-only token receives 403 insufficient_scope on contact routes.

Personal API Key

If you want to access your own data programmatically (listings, contacts, analytics), generate a personal API key from your dashboard. Requires a Signature subscription.

Make sure you have a Signature subscription

Go to API Keys in your dashboard sidebar

Click Create Key and give it a name

Copy your key immediately — it won't be shown again

Use the key as Authorization: Bearer YOUR_API_KEY in all API requests.

OAuth for Partners

Building an app that accesses other users' data? Register as a partner and use OAuth 2.0 to request authorization from Panda IDX users.

Go to Partner Account → Manage Apps in your dashboard

Click Create App and fill in your app details: name, description, logo, and callback URL

Select the scopes your app needs (e.g., listings, contacts, analytics)

Submit for review — the Panda IDX team will approve your app

Once approved, your client_id and client_secret are available in View Credentials from the app dropdown

Use these credentials to implement the OAuth 2.0 flow below.

Make your first request

Search for active listings in Miami with your OAuth access token:

Request

curl --request GET \
  --url "https://api.pandaidx.com/v1/listings?city=Miami&type=sale&limit=5" \
  --header "Authorization: Bearer YOUR_ACCESS_TOKEN" \
  --header "Content-Type: application/json"

Explore all available endpoints in the sidebar, or start with Search Listings.

OAuth 2.0 Flow

All API endpoints require an OAuth access token. Create an OAuth App in your Partner Account → Manage Apps to get your client_id and client_secret.

Redirect user to /authorize with your client_id and scopes

User logs in and authorizes your app on the consent screen

Panda IDX redirects to your callback URL with an authorization code

Exchange the code for an access_token

Use the access_token as Authorization: Bearer header in all API calls

Error Handling

All errors return a JSON object. API endpoints and OAuth endpoints use slightly different formats. Click each status code to see the response body.

400 Bad Request

The request is invalid — missing required fields, malformed data, or expired OAuth code.

API — Invalid parameters

{
  "error": {
    "code": "bad_request",
    "message": "Missing required parameter: city or zip",
    "status": 400
  }
}

OAuth — Expired code

{
  "error": "invalid_grant",
  "error_description": "Invalid or expired authorization code"
}

Versioning

The REST API is versioned in the URL path. Current version: /v1/. Breaking changes ship as /v2/ and never replace /v1/ in place. Clients may send Panda-Api-Version: 1; the path wins if both are present.

When an operation is deprecated, responses include Deprecation: true and Sunset: <HTTP-date> (RFC 8594). /v1/ stays available for at least 12 months after a Sunset date is advertised.

Rate Limits

Standard

60 requests/min

Premium

300 requests/min

Every response includes RFC RateLimit headers so agents can self-throttle: RateLimit, RateLimit-Policy, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset. A 429 Too Many Requests also sends Retry-After. Implement exponential backoff using those headers.

For Partners

Building an integration with Panda IDX? Register as a developer partner to get OAuth credentials and manage your apps.

Access the Manage Apps portal

Create an OAuth App with your redirect URIs and desired scopes

Wait for approval from the Panda IDX team

Receive your client_id and client_secret to start the OAuth flow

Next Steps

MCP Server

Connect Grok, Claude, or ChatGPT to your account — search listings and manage contacts in natural language

Search Listings

Query active MLS listings by location, price, and features

Authorize User

Start the OAuth flow to access user data

List Contacts

Access CRM contacts via OAuth