Build fire intelligence into your product.

Get started

Quickstart

A production integration has four parts: create a key, choose areas, assign those areas to your customer IDs, and register one webhook endpoint.

1. 01Create an organization and API keyUse the Developer Console. Secret values are displayed once.
2. 02Find supported areasSearch the complete department catalog and store stable area_ IDs.
3. 03Configure routingUse organization watches or replace each platform customer’s full area list.
4. 04Receive finalized incidentsVerify the signature, acknowledge with any 2xx response, then route by matching_customer_ids.

1. Find an area

All API requests use the production base URL and a Bearer token.

curl "https://api.lossline.app/v1/areas?query=miami&limit=10" \
  -H "Authorization: Bearer $LOSSLINE_API_KEY"

{
  "data": [
    {
      "id": "area_MDFR",
      "name": "Miami-Dade Fire Rescue",
      "short_name": "Miami-Dade",
      "location": "Miami-Dade County, Florida",
      "latitude": 25.7617,
      "longitude": -80.1918,
      "timezone": "America/New_York",
      "boundary": [/* GeoJSON coordinates */]
    }
  ],
  "page": 1,
  "limit": 10
}

2. Add a platform customer

This request is idempotent. It creates the customer or replaces the customer’s complete area list.

curl -X PUT "https://api.lossline.app/v1/customers/customer_8421" \
  -H "Authorization: Bearer $LOSSLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "area_ids": ["area_MDFR", "area_FL_BSO"],
    "metadata": { "plan": "pro" }
  }'

{
  "data": {
    "id": "customer_8421",
    "status": "active",
    "area_ids": ["area_FL_BSO", "area_MDFR"],
    "backfill_queued": 4
  }
}

3. Register your webhook

The response includes a new whsec_ signing secret exactly once. Store it in your secret manager.

curl -X PUT "https://api.lossline.app/v1/webhook-endpoint" \
  -H "Authorization: Bearer $LOSSLINE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "url": "https://api.example.com/webhooks/lossline" }'

Foundations

Authentication

Authenticate every request with an API key in the Authorization header.

Authorization: Bearer ll_live_••••••••••••••••

Core concepts

How processing works

Lossline turns many source updates into one stable, organization-scoped incident record.

Areas and watches

An area represents one supported department feed. Its stable ID begins with area_.

Platform customers

Use your own opaque identifier. Lossline stores the routing relationship, not your customer’s name, email, or phone number.

• Replace, do not append. Each PUT replaces the complete area list so your system can safely replay its current state.
• Metadata is optional. Store up to 4 KB of non-sensitive routing metadata.
• Delivery is consolidated. One incident includes all matching customer IDs in one array.
• Deactivation is safe. DELETE stops future matching without deleting already finalized incident history.

Incidents and billing

Each unique incident is processed and charged once per organization, even when multiple watched areas or customer subscriptions overlap.

A $1.00 reservation is placed when processing starts. If the final result is not a verified match, $0.25 is returned automatically. Repeated reads, webhook retries, later source updates, and additional matching customers do not create another charge.

Backfill

Adding an organization watch or customer area list automatically scans the previous 24 hours.

• Existing incident records already purchased by the organization are attached to newly matching customer IDs without another charge.
• New historical records are processed newest first while the organization has enough balance.
• Customer-scoped history is available from GET /v1/customers/{customer_id}/incidents.
• Reading historical records never triggers another webhook or charge.

Webhooks

Delivery lifecycle

Lossline sends one POST request for each finalized incident to the organization’s active HTTPS endpoint.

Verify webhook signatures

Use the exact raw request body. Parsing and re-serializing JSON changes the signed bytes.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyLosslineWebhook(req, rawBody, secret) {
  const deliveryId = req.headers["lossline-id"];
  const timestamp = req.headers["lossline-timestamp"];
  const received = req.headers["lossline-signature"]?.replace(/^v1,/, "");

  const age = Math.abs(Date.now() / 1000 - Number(timestamp));
  if (!deliveryId || !timestamp || !received || age > 300) return false;

  const key = secret.replace(/^whsec_/, "");
  const expected = createHmac("sha256", key)
    .update(deliveryId + "." + timestamp + "." + rawBody)
    .digest("base64");

  const a = Buffer.from(received);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Incident payload

The payload is frozen when billing settles. REST reads and every webhook retry return the same record.

{
  "id": "evt_7d9c8b0e-3f6e-4af3-96c1-230ccfb56ac7",
  "type": "incident.finalized",
  "schema_version": "1.0",
  "created_at": "2026-08-17T18:42:11.930Z",
  "matching_customer_ids": ["customer_8421", "customer_9107"],
  "incident": {
    "id": "inc_e12661f9-a182-447f-b8f8-d73c54498a15",
    "event_type": "Structure Fire",
    "severity": "confirmed",
    "status": "active",
    "title": "Residential structure fire",
    "department": {
      "id": "area_MDFR",
      "name": "Miami-Dade Fire Rescue"
    },
    "location": {
      "address": "1400 Collins Avenue",
      "city": "Miami Beach",
      "state": "FL",
      "postal_code": "33139",
      "latitude": 25.7865,
      "longitude": -80.1301
    },
    "dispatch": {
      "reported_at": "2026-08-17T18:39:02.000Z",
      "last_updated_at": "2026-08-17T18:41:44.000Z",
      "closed_at": null,
      "units": ["E1", "E2", "L1"],
      "summary": "3 units responding"
    }
  },
  "enrichment": {
    "status": "matched",
    "owner_name": "Collins 1400 Holdings LLC",
    "owner_type": "business",
    "phones": ["+13055550136"],
    "emails": ["office@example.com"],
    "mailing_address": "1400 Collins Avenue, Miami Beach, FL 33139",
    "property": {
      "estimated_value": 6200000,
      "year_built": 1956,
      "last_sold_year": 2021
    }
  },
  "billing": {
    "amount_cents": 100,
    "amount": 1,
    "currency": "usd"
  }
}

Retries and acknowledgements

Return any 2xx status within 15 seconds. Redirects are not followed.

After eight unsuccessful attempts, the delivery is marked failed. Delivery state and attempt history remain visible in the Developer Console.

Resources

Pagination and request limits

List endpoints return page and limit. Request the next page until data.length is smaller than the requested limit.

Errors

Errors use an HTTP status and a stable machine-readable string.

{
  "error": "one_or_more_areas_not_found"
}