Vendor API integration

Every request to the vendor API is authenticated with a per-vendor API key, issued by a SyncLine admin. Send it on every request in the X-API-Key header.

curl -H "X-API-Key: loomi_sk_XXXXXXXXXXXXXXXXXXXXXXXX" \
  https://synclineresearch.com/api/v1/ping

• Keys are prefixed with loomi_sk_ and shown only once at creation. Rotate at any time from the admin console.
• Invalid or inactive keys return 401. Never embed keys in a browser bundle.

Pull the live project catalog. Each project includes CPI, LOI, incidence rate, target N, quotas, and the entry URL template.

curl -H "X-API-Key: loomi_sk_XXXXXXXXXXXXXXXXXXXXXXXX" \
  https://synclineresearch.com/api/v1/projects

Response shape (abbreviated):

{
  "vendor_id": "vnd_A1B2C3",
  "count": 3,
  "projects": [
    {
      "id": "acme_q1",
      "name": "Consumer Habits Q1",
      "cpi": 2.5,
      "loi_minutes": 12,
      "incidence_rate_pct": 45,
      "target_n": 500,
      "quotas": { "country": { "US": 300, "IN": 200 } },
      "entry_url_template": "https://synclineresearch.com/api/survey/entry?pid=acme_q1&rid=[YOUR_RID]&vid=[VENDOR_ID]&sub_id=[YOUR_PANELIST_ID]"
    }
  ]
}

Redirect your panelist's browser to the entry URL, populating the placeholders with your values:

https://synclineresearch.com/api/survey/entry?pid={PROJECT_ID}&rid={YOUR_UNIQUE_RID}&vid={YOUR_VENDOR_ID}&sub_id={YOUR_PANELIST_ID}

• pid — the project ID from the feed.
• rid — a unique respondent identifier per attempt (used for idempotency).
• vid — your vendor ID (from onboarding).
• sub_id — your internal panelist ID (round-trips back to you in the postback).

SyncLine will redirect to the client's survey URL and, upon exit, land the respondent on a signed status page.

Set a postback_url on your vendor record. SyncLine sends a signed JSON POST as soon as an exit event is recorded (complete, terminate, overquota, quality_term, security_term). Delivery is fire-and-forget with a 6s timeout.

{
  "event": "session.exit",
  "session_id": "8b7d2c…",
  "project_id": "ecom_q1_2026",
  "vendor_id": "vnd_A1B2C3",
  "vendor_sub_id": "your-internal-panelist-id",
  "rid": "abc123",
  "status": "complete",
  "timestamp": "2026-02-26T12:34:56+00:00"
}

Headers:

X-SyncLine-Signature: sha256=<hex>
X-SyncLine-Event: session.exit
Content-Type: application/json
User-Agent: loomi-webhook/1.0

Verify the signature with your webhook_secret:

import hmac, hashlib

body = request.body  # raw bytes
sig  = request.headers["X-SyncLine-Signature"]  # e.g. "sha256=abc..."
expected = "sha256=" + hmac.new(WEBHOOK_SECRET.encode(), body, hashlib.sha256).hexdigest()

if not hmac.compare_digest(sig, expected):
    return 401  # tampered or wrong secret

Pull attributed sessions and revenue stats at any time.

curl -H "X-API-Key: loomi_sk_XXXXXXXXXXXXXXXXXXXXXXXX" \
  https://synclineresearch.com/api/v1/stats

GET /api/v1/reconciliation?status=complete&project_id=acme_q1
GET /api/v1/reconciliation?status=terminate