Dotloop API
Dotloop is a real estate transaction management platform that combines form creation, e-signature, and transaction workflow into a single end-to-end system for agents, teams, and brokerages. Its Public API v2 lets you programmatically create loops, manage profiles, contacts, documents, and participants, and subscribe to webhooks—but OAuth token refresh, partner registration, and per-account customization make reliable production access harder than it looks.
What is Dotloop?
Dotloop is a real estate transaction management platform that replaces separate form creation, e-signature, and transaction-tracking systems with a single end-to-end solution. Agents, teams, and brokerages use Dotloop to build and edit documents, collect legally binding e-signatures, organize every deal as a "loop," communicate with clients over email, SMS, or fax, and give office leaders real-time visibility into transaction status across the brokerage.
Core product areas include:
- Interactive document editor with customizable forms and templates
- Legally binding e-signatures and document sharing
- Loops (transactions) with folders, tasks, and activity tracking
- Contact directory and client communication (email, SMS, fax)
- Broker dashboards with real-time transaction visibility and reporting
- Public API v2 and 75+ partner integrations across CRM, back office, and marketing
Common data entities:
- Profiles (individual agent and brokerage accounts)
- Loops, Loop Details, and Loop Templates
- Folders and Documents
- Participants and Contacts
- Tasks, Task Lists, and Activities
- Webhook subscriptions and events
The Dotloop Integration Challenge
Dotloop publishes a documented Public API v2, but turning it into reliable production automation across many brokerages still takes real work:
- Partner registration gate: API access requires registering at info.dotloop.com/developers to receive a client ID and secret before any integration can run
- OAuth 2.0 token lifecycle: Access tokens expire roughly every 12 hours and must be refreshed proactively or lazily on a 401, which headless jobs often mishandle
- Deeply nested resource paths: Documents and folders live under /profile/:id/loop/:loop_id/folder/:folder_id, so callers must walk profile → loop → folder hierarchies for most operations
- Rate limits: 100 requests per minute per client per user, with 429s and X-RateLimit headers that batch and sync jobs must respect
- Per-brokerage customization: Loop templates, form sets, and task lists vary by office, so a single hard-coded mapping breaks across accounts
- Webhook plumbing: Subscriptions deliver HTTPS POST payloads with HMAC-SHA1 signatures and retry semantics that you must verify, dedupe, and persist
How Supergood Creates Dotloop APIs
Supergood wraps Dotloop's Public API v2 and authenticated app surfaces in a resilient layer so you integrate once and rely on consistent objects—across many brokerage profiles—without managing OAuth refresh, nested paths, or rate limits yourself.
- Manages OAuth 2.0 client credentials, token refresh, and 401 recovery in a hardened session
- Flattens the profile → loop → folder → document hierarchy into clean, normalized objects
- Respects the 100 req/min limit with adaptive throttling, backoff, and retry
- Verifies HMAC-SHA1 webhook signatures and turns loop, participant, and contact events into reliable, deduped streams
Use Dotloop with AI agents: Dotloop MCP Server →
Getting Started
- Schedule Integration Assessment
Book a 30-minute session to confirm the profiles, loops, and document workflows you need to automate.
- Supergood Generates and Validates Your API
We deliver a production-ready Dotloop adapter tuned to your brokerage's templates, forms, and entitlements.
- Deploy with Monitoring
Go live with continuous monitoring and automatic adjustments as Dotloop's API and app evolve.
API Endpoints
Authentication
/authenticateAuthenticate via OAuth 2.0 using your client ID and secret, exchange the authorization grant, and obtain a Bearer access token for downstream calls.
Profiles
/profilesList the agent and brokerage profiles accessible to the authenticated account, or retrieve an individual profile by id.
Loops
/loopsList loops (transactions) for a profile with filters for status, transaction type, and update time, or retrieve a single loop's details.
Loops
/create_loopCreate a new loop with the Loop-It facade, populating transaction details, participants, and contacts in a single call.
Documents
/documentsList and download documents within a loop's folders, walking the profile, loop, and folder hierarchy.
Contacts
/create_contactCreate or update contacts in the directory and keep them synced across integrated CRM and back-office tools.
Use Cases
Sync transactions into your CRM and back office
- Pull loops, loop details, and statuses from each brokerage profile into a single warehouse - Stream participant and contact changes to keep CRM records in sync - Surface closing dates and milestones to reporting and commission systems
Automate loop creation from external systems
- Use Loop-It to create a new transaction directly from your CRM or lead source - Pre-populate participants, contacts, and transaction details on creation - Apply the brokerage's loop template so forms and tasks are ready on day one
Centralize documents and e-signature status
- Pull executed documents and folder contents from every loop for archival - Track document and signature completion across active transactions - Push final closing packages into a document management or accounting system
React to transaction events in real time
- Subscribe to webhook events for loop creation, updates, and participant changes - Verify HMAC-SHA1 signatures and dedupe deliveries before processing - Trigger downstream automations like compliance reviews and back-office tasks
Technical Specifications
Authentication
OAuth 2.0 with client ID/secret and Bearer access tokens, refreshed automatically in a managed session
Connectivity
Dotloop Public API v2 at api-gateway.dotloop.com/public/v2 plus authenticated app surfaces where needed
Response format
Normalized JSON across profiles, loops, folders, documents, participants, and contacts
Rate limits
Adaptive throttling within Dotloop's 100 requests/minute per client per user limit, honoring X-RateLimit headers
Session management
Automatic 12-hour token refresh, 401 recovery, and credential rotation
Data freshness
Near real-time pulls for loops, documents, and contacts with optional scheduled batch syncs
Security
Encrypted credential vault, scoped access tokens, SOC 2-aligned controls, and audit logging
Webhooks
Subscription-based HTTPS callbacks with HMAC-SHA1 signature verification for loop, participant, and contact events
Latency
Sub-second reads on cached entities; multi-second writes when creating loops and uploading documents
Throughput
Horizontally scaled workers sized to brokerage-wide loop and document volume across many profiles
Reliability
Retry, backoff, and idempotency handling for loop creation, document, and contact writes
Adaptation
Continuous monitoring of Dotloop API releases, webhook event changes, and per-brokerage template drift
Frequently asked questions
Yes. Dotloop publishes Public API v2 with OAuth 2.0 authentication. Supergood wraps it in a resilient layer that manages token refresh, nested resource paths, and rate limits, and falls back to authenticated app surfaces where the public API is thin.
Dotloop requires registering at info.dotloop.com/developers to obtain a client ID and secret. Supergood handles the OAuth client credentials and token lifecycle so your integration stays authenticated without manual refresh.
Dotloop enforces 100 requests per minute per client per user and returns 429s with X-RateLimit headers. Supergood applies adaptive throttling, backoff, and retry so batch and sync jobs stay within the limit automatically.
Yes. Using the Loop-It facade and the loop, participant, and contact endpoints, Supergood can create transactions, populate participants and contacts, and keep records synced two-way between Dotloop and your systems.
Yes. Supergood subscribes to Dotloop webhook events for loop creation, updates, and participant changes, verifies the HMAC-SHA1 signatures, and delivers deduped, reliable event streams to your downstream automations.