DealerKit API probe 2026-09-07T21:42:43 tenant https://really-easy-car-credit.app.dealerkit.uk key set
A. Integrator API with the key, from this Mac
GET api.dealerkit.uk/integrators/dealers: HTTP 200 json 528b {"data":[],"links":{"first":"https:\/\/api.dealerkit.uk\/integrators\/dealers?page=1","last":"https:\/\/api.dealerkit.uk\/integrators\/dealers?page=1","prev":nu
GET api.dealerkit.uk/integrators/webhooks: HTTP 200 json 11b {"data":[]}
B. The tenant's main API with the key as a bearer, no cookies
GET /api/stocklist?limit=1&offset=0: HTTP 401 json 30b {"message":"Unauthenticated."}
GET /api/user: HTTP 404 json 21b { "message": "" }
GET /api/me: HTTP 404 json 21b { "message": "" }
B2. The Integrator paths on the tenant host with the key
GET /integrators/dealers: HTTP 404 json 21b { "message": "" }
GET /integrators/stock?dealer_id=1: HTTP 404 json 21b { "message": "" }
C. The tenant's main API with no key and no cookies (what a stranger sees)
GET /api/stocklist?limit=1&offset=0: HTTP 401 json 30b {"message":"Unauthenticated."}
D. With the saved login: candidate routes
saved login alive for the API: True
/api/user: HTTP 404 json 21b { "message": "" }
/api/me: HTTP 404 json 21b { "message": "" }
/api/auth/user: HTTP 404 json 21b { "message": "" }
/api/profile: HTTP 404 json 21b { "message": "" }
/api/documentation: HTTP 404 json 21b { "message": "" }
/api/docs: HTTP 404 json 21b { "message": "" }
/docs: HTTP 404 json 21b { "message": "" }
/api/openapi.json: HTTP 404 json 21b { "message": "" }
/openapi.json: HTTP 404 json 21b { "message": "" }
/api-docs: HTTP 404 json 21b { "message": "" }
/api/tokens: HTTP 404 json 21b { "message": "" }
/api/personal-access-tokens: HTTP 404 json 21b { "message": "" }
/user/api-tokens: HTTP 404 json 21b { "message": "" }
/settings/api-tokens: HTTP 404 json 21b { "message": "" }
/settings/api: HTTP 404 json 21b { "message": "" }
/settings/integrations: HTTP 404 json 21b { "message": "" }
/api/integrations: HTTP 404 json 21b { "message": "" }
/api/settings: HTTP 404 json 21b { "message": "" }
/api/webhooks: HTTP 404 json 21b { "message": "" }
/api/expenses: HTTP 200 json 50166b {"total":610,"from":1,"to":25,"offset":0,"limit":25,"results":[{"tax_at":"2026-09-07T14:47:05+00:00","status":"authorize
/api/expense-items: HTTP 404 json 21b { "message": "" }
/api/purchases: HTTP 404 json 21b { "message": "" }
/api/vehicles: HTTP 200 json 73745b {"total":234,"from":1,"to":25,"offset":0,"limit":25,"results":[{"vehicle_type":"Car","specification_id":"af37145e215649e
/api/leads: HTTP 200 json 63b {"total":0,"from":1,"to":25,"offset":0,"limit":25,"results":[]}
/api/customers: HTTP 404 json 21b { "message": "" }
/api/contacts?limit=1: HTTP 200 json 829b {"total":232,"from":1,"to":1,"offset":0,"limit":1,"results":[{"title":null,"first_name":null,"last_name":null,"company_n
/api/valuations: HTTP 404 json 21b { "message": "" }
/api/valuation: HTTP 404 json 21b { "message": "" }
/api/dealers: HTTP 404 json 21b { "message": "" }
/api/dealer: HTTP 404 json 21b { "message": "" }
/api/locations: HTTP 200 json 719b [{"name":"Pitch","primary_telephone":"0191 580 4227","alternate_telephone":null,"email":"sales@reallyeasycarcredit.co.uk
/api/users: HTTP 200 json 6583b [{"id":10,"username":"3BNa2Gn0iqLolwZ5","first_name":"67 Degrees","last_name":"","email":null,"secondary_email":null,"mo
/api/documents: HTTP 405 json 93b { "message": "The GET method is not supported for this route. Supported methods: POST." }
/api/media: HTTP 404 json 21b { "message": "" }
/api/images: HTTP 404 json 21b { "message": "" }
/api/stocklist?limit=1&offset=0: HTTP 200 json 22505b {"total":155,"from":1,"to":1,"offset":"0","limit":1,"results":[{"vehicle_id":2,"location_id":1,"owner_id":184,"siv_base"
/api/funding?limit=1: HTTP 200 json 61b {"total":0,"from":1,"to":1,"offset":0,"limit":1,"results":[]}
/api/reservations: HTTP 404 json 21b { "message": "" }
/api/sales: HTTP 404 json 21b { "message": "" }
/api/deals: HTTP 200 json 658279b {"total":86,"from":1,"to":25,"offset":0,"limit":25,"results":[{"id":1,"created_by_id":4,"created_at":"2026-07-22T10:21:2
/api/invoices: HTTP 200 json 89788b {"total":130,"from":1,"to":25,"offset":0,"limit":25,"results":[{"id":134,"created_by_id":5,"created_at":"2026-09-05T14:4
/api/reports: HTTP 404 json 21b { "message": "" }
/sanctum/csrf-cookie: HTTP 404 json 21b { "message": "" }
/api/routes: HTTP 404 json 21b { "message": "" }
/telescope: HTTP 404 json 21b { "message": "" }
/horizon: HTTP 404 json 21b { "message": "" }
E. Every /api/ path the front end's own scripts mention
page scripts: 6
https://widget.intercom.io/widget/e9a99cim: 7614b, 0 api paths
https://aws.cdn.dealerkit.com/platform/js/manifest.816d0518ba4324ad.js: 6750b, 0 api paths
https://aws.cdn.dealerkit.com/platform/js/sentry.f4e403ff738093ee.js: 268226b, 0 api paths
https://aws.cdn.dealerkit.com/platform/js/vendor.7cfdbd33bf963dbd.js: 7618011b, 0 api paths
https://aws.cdn.dealerkit.com/platform/js/app.82681a949b996c36.js: 2521133b, 1 api paths
https://hz1wypyrf7m2.statuspage.io/embed/script.js: 1626b, 0 api paths
1 distinct /api/ paths:
/api/inbox/attachments
F. Route strings and sign in words in the front end's own bundle
https://aws.cdn.dealerkit.com/platform/js/manifest.816d0518ba4324ad.js: 0 route strings
https://aws.cdn.dealerkit.com/platform/js/sentry.f4e403ff738093ee.js: 0 route strings
https://aws.cdn.dealerkit.com/platform/js/vendor.7cfdbd33bf963dbd.js: 5 route strings
https://aws.cdn.dealerkit.com/platform/js/app.82681a949b996c36.js: 113 route strings
118 distinct route strings:
/pusher/auth
/pusher/user-auth
/a/b
/vue2-daterange-picker/dist
/a/i
/broadcasting/auth
/broadcasting/user-auth
/accounting-integration/overview
/accounting-integration/batches
/bank-transactions/{id}
/chart-of-accounts/{id}
/bank-transaction-allocations/{id}
/accounting-integration/batches/{id}/download
/accounting-integration/batches/{id}/process
/ai-auto-entry/status
/accounting-integration/batches/{id}
/accounting/exports/sage-50
/accounting/exports/xero
/advertising-description-templates/{id}
/assistant-discussions/{id}/messages
/assistant-discussions/{id}
/auth/support-access/logs
/auth/support-access
/referral-sources/{id}
/contacts/{id}/template-data-sources
/knowledge/{id}
/company/billing/invoices/{id}/pdf
/company/branding
/company/billing/invoices
/company/billing/next-invoice-estimate
/company/phone-and-email-addresses
/company/billing/usage
/knowledge/search
/contacts/{id}
/contacts/import
/contacts/validate-import
/sundry-items/{sku}
/deals/{id}/requote-products
/documents/associate
/documents/destroy
/documents/remove-background
/expenses/import
/expenses/validate-import
/finance-commission/{id}
/finance-contras/{id}
/finance-settlements/{id}
/inbox/ai-responses/{id}/cancel
/inbox/ai-agent-actions/{id}/complete
/inbox/ai-responses/{id}/send
/inspection-types/{id}
/jobs/types/{id}
/jobs/types
/jobs/groups
/jobs/groups/{group}
/kits/{id}
/kits/{id}/fit
/kits/{id}/unfit
/lead-pipelines/{id}
/lead-pipelines/reorder
/lead-pipelines/{id}/restore
/leads/{id}
/locations/{id}
/locations/{id}/move-stock
/locations/{id}/restore
/offers/{id}/convert
/offers/{id}
/parts/{id}
/part-orders/{id}
/parts/search
/preparation/stock-listings/{id}/complete-stage
/preparation/stage-summary
/preparation/stock-listings/{id}/stage-summary
/preparation/stock-listings/{id}/enter-stage
/products/{id}
/purchased-products/{product}/refund
/products/{id}/withdraw
/background-reports/{report}/download
/background-reports/{report}/status
/settings/job-clean-up
/settings/house-costs/{handle}
/settings/sales/teams/{id}/handover-booking
/settings/accounting
/settings/advertising
/settings/sales-volume-targets
/settings/crm
/settings/house-costs
/settings/jobs/labour-rates/{type}
/settings/jobs
/settings/stock/mot-job-card-automation
/settings/sales
/settings/stock
/settings/crm/whatsapp/reset
/stock-list/{id}/pricing-insights
/stock-list/feed
/stock-list/feed/facets
/stock-list/feed/finance-representative
/stock-list/search
/teams/{id}
/templates/{id}
/templates/{id}/render
/users/me/grid-state/{grid}
/vehicle-appraisals/{appraisal}
/vehicles/{vehicle}/current-valuation
/vehicles/{vehicle}
/vehicles/{vehicle}/valuations
/vehicles/{id}/refresh-gov-data
/vehicles/{vehicle}/value
/write-downs/{id}
/inbox/waiting
/users/me/challenge
/jobs/documents/booking-job-sheet
/money/expenses
/inbox/mine
/inbox/ai
/inbox/follow-up
/inbox/closed
/inbox/junk
/inbox/bin
sign in words (9):
'api-token': 1 in m/platform/js/sentry.f4e403ff738093ee.js
... utes.name)||"verification"===ke(t.attributes.name)||"shopify-checkout-api-token"===ke(t.attributes.name)))return!0}}return!1}(M,_)&&(R||M.type!==Ht.T ...
'passport': 2 in m/platform/js/vendor.7cfdbd33bf963dbd.js
... alt:before{content:"\\f2f6"}.b-fa-venus:before{content:"\\f221"}.b-fa-passport:before{content:"\\f5ab"}.b-fa-heart-pulse:before,.b-fa-heartbeat:befo ...
... "\\f2f6";\n}\n\n.b-fa-venus::before{\n content:"\\f221";\n}\n\n.b-fa-passport::before{\n content:"\\f5ab";\n}\n\n.b-fa-heart-pulse::before{\n con ...
'baseURL': 4 in m/platform/js/vendor.7cfdbd33bf963dbd.js
... in t?o(n,i):r in e?o(void 0,n):void 0}const l={url:r,method:r,data:r,baseURL:a,transformRequest:a,transformResponse:a,paramsSerializer:a,timeout:a ...
... kieName:r,headers:a,auth:s}=t;if(t.headers=a=ke.from(a),t.url=ce($e(t.baseURL,t.url,t.allowAbsoluteUrls),e.params,e.paramsSerializer),s&&a.set("Aut ...
... Urls:t.allowAbsoluteUrls=!0),At.assertOptions(t,{baseUrl:pt.spelling("baseURL"),withXsrfToken:pt.spelling("withXSRFToken")},!0),t.method=(t.method| ...
'withCredentials': 22 in m/platform/js/vendor.7cfdbd33bf963dbd.js
... a,"SUPPORT_RESPONSE_TYPE",{value:e}),e},get SUPPORT_CORS_XHR(){var e="withCredentials"in new XMLHttpRequest;return Object.defineProperty(wa,"SUPPORT_CORS_X ...
... h(e){}};var Jt={0:200,1223:204},Zt=w.ajaxSettings.xhr();h.cors=!!Zt&&"withCredentials"in Zt,h.ajax=Zt=!!Zt,w.ajaxTransport(function(e){var t,n;if(h.cors||Z ...
... PDFNetworkStream({url:o.url,length:o.length,httpHeaders:o.httpHeaders,withCredentials:o.withCredentials,rangeChunkSize:o.rangeChunkSize,disableRange:o.disa ...
'XSRF': 5 in m/platform/js/vendor.7cfdbd33bf963dbd.js
... is,null,this.response);throw e}}}return e}],timeout:0,xsrfCookieName:"XSRF-TOKEN",xsrfHeaderName:"X-XSRF-TOKEN",maxContentLength:-1,maxBodyLengt ...
... }}}return e}],timeout:0,xsrfCookieName:"XSRF-TOKEN",xsrfHeaderName:"X-XSRF-TOKEN",maxContentLength:-1,maxBodyLength:-1,env:{FormData:me.classes. ...
... a,paramsSerializer:a,timeout:a,timeoutMessage:a,withCredentials:a,withXSRFToken:a,adapter:a,responseType:a,xsrfCookieName:a,xsrfHeaderName:a,onU ...
'apiToken': 2 in .com/platform/js/app.82681a949b996c36.js
... kit.pusher_cluster,forceTLS:!0,auth:{headers:{"X-Api-Token":marque.ui.apiToken,"X-Csrf-Token":marque.ui.csrfToken,Accept:"application/json"}}})},884 ...
... KEN"]=Ze.ui.csrfToken,tt.defaults.headers.common["X-API-TOKEN"]=Ze.ui.apiToken,tt.defaults.headers.common["X-Requested-With"]="XMLHttpRequest",Xe&&e ...
'Bearer ': 3 in .com/platform/js/app.82681a949b996c36.js
... =this.options.bearerToken)&&(this.options.auth.headers.Authorization="Bearer "+t,this.options.userAuthentication.headers.Authorization="Bearer "+t) ...
... on="Bearer "+t,this.options.userAuthentication.headers.Authorization="Bearer "+t),e}},{key:"csrfToken",value:function(){var e;return"undefined"!=ty ...
... 2:return e.n=3,n.accessToken;case 3:r=e.v;case 4:i=r,t.Authorization="Bearer "+i;case 5:return e.a(2)}},e)}));return function(t,n){return e.apply(t ...
'X-API': 1 in .com/platform/js/app.82681a949b996c36.js
... rs.common["X-CSRF-TOKEN"]=Ze.ui.csrfToken,tt.defaults.headers.common["X-API-TOKEN"]=Ze.ui.apiToken,tt.defaults.headers.common["X-Requested-With"] ...
'apiKey': 2 in .com/platform/js/app.82681a949b996c36.js
... hrow new TypeError("Cannot call a class as a function")}(this,e),this.apiKey=t.apiKey,this.username=t.username,this.password=t.password,this.acces ...
... TypeError("Cannot call a class as a function")}(this,e),this.apiKey=t.apiKey,this.username=t.username,this.password=t.password,this.accessToken=t. ...
H. The page's own API token, tried with no cookies
marque.ui keys: account, accountingIntegrationProvider, apiToken, apiUrl, app, appUrl, authenticated, authorisations, autoProtectDealerId, autoTraderCoDriver, autoTraderConnect, autotraderSyncMethod, availableVatTariffs, baseEndpoint, baseUrl, contact_attribute_defaults, courtesyCarCalendarId, csrfToken, defaultAdChannels, defaultNonAccountableExpenseCategory, defaultVehicleExpenseCategory, features, financeDefaults, fundingFinanceHouses, googleMapsKey, hasAdvertisingDescriptionTemplate, inspectionMappings, localisation, location, otherReferralSource, paymentMethods, priceTracking, revalidation, services, signatures, targetMargin, tweaks, user
apiToken: 728 characters, shape aaaaaaaaaaaa...
fingerprint: ccf30073d3
X-API-TOKEN only /api/stocklist?limit=1&offset=0: HTTP 401 json 30b {"message":"Unauthenticated."}
X-API-TOKEN only /api/deals?limit=1: HTTP 401 json 30b {"message":"Unauthenticated."}
X-API-TOKEN only /api/vehicles?limit=1: HTTP 401 json 30b {"message":"Unauthenticated."}
X-API-TOKEN + X-Requested-With /api/stocklist?limit=1&offset=0: HTTP 401 json 30b {"message":"Unauthenticated."}
X-API-TOKEN + X-Requested-With /api/deals?limit=1: HTTP 401 json 30b {"message":"Unauthenticated."}
X-API-TOKEN + X-Requested-With /api/vehicles?limit=1: HTTP 401 json 30b {"message":"Unauthenticated."}
Authorization Bearer /api/stocklist?limit=1&offset=0: HTTP 401 json 30b {"message":"Unauthenticated."}
Authorization Bearer /api/deals?limit=1: HTTP 401 json 30b {"message":"Unauthenticated."}
Authorization Bearer /api/vehicles?limit=1: HTTP 401 json 30b {"message":"Unauthenticated."}
G. The sign in page with no cookies
GET /login: HTTP 200, 4262b, 1 form(s)