Developer API · updated 2026-08-22

Get started with the Dumpster Controls API

The Dumpster Controls API is a public REST API that lets your own software read your company data and push in leads, with real-time signed webhooks. It is included free, approval-gated, and always scoped to your company only. This guide takes you from zero to your first successful API call in about five minutes.

1. 1

   Request access

   In the app, open Settings, then API. Read the overview, describe what you plan to connect (for example "sync new orders into my GoHighLevel account"), and submit. Our team reviews every request quickly and approves or declines it. Keys never work before approval: this is a hard server-side rule, checked on every single request.

2. 2

   Create your first key

   Once approved, the same screen lets you create a key. Give it a name that says where it will live ("Zapier", "our CRM server"). The full key, starting with dc_live_, is shown exactly once: copy it and store it in your secret manager. Only its fingerprint stays in our database.

3. 3

   Make your first call

   From your server or an API tool, send the key as a Bearer token:

   curl -H "Authorization: Bearer dc_live_YOUR_KEY" \
     "https://gcwyoiihrupbfqqlcurh.supabase.co/functions/v1/api-v1/v1/orders?per_page=5"

   You get JSON back: a data array of orders, plus page, per_page and has_more for pagination. If you are on the free plan, read responses also carry the X-DC-Window-Remaining header with the seconds left in your daily window.

4. 4

   Understand the base URL

   All endpoints live under one base URL:

   https://gcwyoiihrupbfqqlcurh.supabase.co/functions/v1/api-v1/v1

   Append the endpoint path: /orders, /customers, /estimates, /sizes, /junk-jobs, /leads. The full machine-readable spec (OpenAPI 3) is published at dumpstercontrols.io/openapi.json and the quick reference lives at dumpstercontrols.io/developers.

5. 5

   Know the ground rules

   Three rules shape everything: (1) your key only ever sees YOUR company data, enforced server-side on every query; (2) money is out of scope by design (no refunds, charges or price changes through the API, ever); (3) the key is a server-side secret. Browser calls are rejected on purpose (no CORS), so the key never belongs in front-end code.