Eagle Partner API

Getting started

The Eagle Partner API is a GraphQL API — you POST a JSON body containing a query string and variables, and receive a JSON response. Here are the three steps to connect:

1. Receive your credentials. Eagle provisions your partner client with a client ID, client secret, and access to specific Eagle accounts. Contact Eagle support to get set up.
2. Get a session token. POST /api/v3/partner_graphql/token with HTTP Basic auth. The response contains a JWT valid for 24 hours. See Get a token.
3. Make GraphQL requests. POST /api/v3/partner_graphql with Authorization: Bearer <token> and an accountId on every query or mutation. See Make a request.

Get a session token

Base64-encode CLIENT_ID:CLIENT_SECRET, then send a POST to the token endpoint with that value as a Basic auth header. No request body is needed.

Request

curl \
  -X POST \
  -H "Authorization: Basic BASE64_OF_CLIENT_ID_COLON_SECRET" \
  https://www.eagleagent.com.au/api/v3/partner_graphql/token

Response

{
  "data": {
    "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9...",
    "expires_at": 1720000000
  }
}

How to Base64-encode your credentials

# macOS / Linux
echo -n "your_client_id:your_client_secret" | base64

# PowerShell
[Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("your_client_id:your_client_secret"))

Make a GraphQL request

POST JSON to /api/v3/partner_graphql with Authorization: Bearer TOKEN. The body must contain a query field and an optional variables map. Include accountId inside your variables on every query or mutation.

Request format

curl \
  -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_SESSION_TOKEN" \
  --data '{"query": "query Ping { partnerPing }", "variables": {}}' \
  https://www.eagleagent.com.au/api/v3/partner_graphql

Response

{ "data": { "partnerPing": "pong" } }

Request body fields

Pagination

All list queries use cursor-based pagination. Pass first for the page size and after for the cursor. Read pageInfo from each response to determine whether more pages exist.

Example

query ListContacts($accountId: ID!, $first: Int!, $after: String) {
  contacts(accountId: $accountId, first: $first, after: $after) {
    nodes { id firstName lastName email }
    pageInfo { hasNextPage endCursor }
  }
}

First page:

{ "accountId": "123", "first": 25 }

Next page — use endCursor from the response above:

{ "accountId": "123", "first": 25, "after": "eyJpZCI6Mn0" }

Connectivity queries

Use these before running real queries to confirm your token and account access are working.

query {
  partnerPing
}

{ "data": { "partnerPing": "pong" } }

query Probe($accountId: ID!) {
  partnerPermissionProbe(
    accountId: $accountId
  )
}

{ "accountId": "123" }

Contacts

Query contacts for an authorised account. Supports listing with pagination and fetching a single contact by ID.

Query arguments

Contact object fields

List contacts

query GetContacts($accountId: ID!, $first: Int!, $after: String, $query: String, $email: String) {
  contacts(accountId: $accountId, first: $first, after: $after, query: $query, email: $email) {
    nodes {
      id
      firstName
      lastName
      email
      mobilePhone
      suburb
      state
    }
    pageInfo { hasNextPage endCursor }
  }
}

{ "accountId": "123", "first": 25 }

Get a single contact

query GetContact($accountId: ID!, $id: ID!) {
  contact(accountId: $accountId, id: $id) {
    id
    firstName
    lastName
    fullName
    email
    mobilePhone
    company
    suburb
    state
    postcode
    legalName
    createdAt
    updatedAt
  }
}

{ "accountId": "123", "id": "456" }

Properties

Query property listings for an authorised account.

Query arguments

Property object fields

List properties

query GetProperties($accountId: ID!, $first: Int!, $after: String, $status: [String!]) {
  properties(accountId: $accountId, first: $first, after: $after, status: $status) {
    nodes {
      id
      formattedAddress
      status
      saleOrLease
      bedrooms
      bathrooms
      postcode {
        ... on PostcodeAustralia { suburb state postcode }
        ... on PostcodeNewZealand { suburb postcode }
      }
    }
    pageInfo { hasNextPage endCursor }
  }
}

{ "accountId": "123", "first": 25, "status": ["Current"] }

Get a single property

query GetProperty($accountId: ID!, $id: ID!) {
  property(accountId: $accountId, id: $id) {
    id
    formattedAddress
    unit
    streetNo
    street
    postcode { ... on PostcodeAustralia { suburb state postcode } }
    status
    bedrooms
    bathrooms
    landSize
    landSizeUnits
    latitude
    longitude
    listedAt
    thumbnailSquare
  }
}

{ "accountId": "123", "id": "789" }

Addresses

Address records are physical locations in Eagle, separate from active property listings.

Query arguments

Address object fields

Example

query GetAddresses($accountId: ID!, $first: Int!, $after: String, $query: String) {
  addresses(accountId: $accountId, first: $first, after: $after, query: $query) {
    nodes {
      id
      formattedFullAddress
      bedrooms
      bathrooms
      postcode { ... on PostcodeAustralia { suburb state postcode } }
    }
    pageInfo { hasNextPage endCursor }
  }
}

{ "accountId": "123", "first": 25 }

Appraisals

Query appraisal records for an authorised account.

Query arguments

Appraisal object fields

Example

query GetAppraisals($accountId: ID!, $first: Int!, $after: String) {
  appraisals(accountId: $accountId, first: $first, after: $after) {
    nodes {
      id
      formattedAddress
      status
      saleOrRent
      bedrooms
      bathrooms
      appraisalDate
      postcode { ... on PostcodeAustralia { suburb state postcode } }
    }
    pageInfo { hasNextPage endCursor }
  }
}

{ "accountId": "123", "first": 25 }

Compliance Checks (AML)

Compliance checks (internally called AML checks) let you read identity-verification records associated with contacts. The GraphQL field names use the amlCheck prefix. The Compliance Checks feature must be enabled on the target account.

Query arguments — amlChecks (list)

Query arguments — amlCheck (single)

AmlCheck object fields

List compliance checks

query GetAmlChecks($accountId: ID!, $first: Int!, $after: String, $status: AmlCheckStatusEnum) {
  amlChecks(accountId: $accountId, first: $first, after: $after, status: $status) {
    nodes {
      id
      status
      note
      source
      partnerApiClientId
      contactType
      entityType
      portalUrl
      externalId
      createdAt
      updatedAt
      contact { id firstName lastName email }
      attachments { id fileName downloadUrl }
    }
    pageInfo { hasNextPage endCursor }
  }
}

{ "accountId": "123", "first": 25, "status": "IN_PROGRESS" }

Get a single compliance check

query GetAmlCheck($accountId: ID!, $id: ID!) {
  amlCheck(accountId: $accountId, id: $id) {
    id
    status
    note
    source
    partnerApiClientId
    contactType
    entityType
    portalUrl
    externalId
    createdAt
    updatedAt
    statusUpdatedAt
    contact { id firstName lastName email }
    attachments { id fileName downloadUrl status }
    properties { id formattedAddress status }
    appraisals  { id formattedAddress status }
  }
}

{ "accountId": "123", "id": "1001" }

Get the transaction context (agency, office & agent)

A common need when processing an AML notification is the Agency ID (Eagle account), the Office ID, and the agent's email so the check can be assigned to the right person. All three are already available on the amlCheck in a single query — no extra calls required. The agent is exposed via the user field, and their email is at user.email.

query GetAmlCheckContext($accountId: ID!, $id: ID!) {
  amlCheck(accountId: $accountId, id: $id) {
    id
    externalId
    status

    # Agency ID (Eagle account)
    accountId

    # Office ID + contact details
    office {
      id
      name
      email
      phone
    }

    # The agent the check is attributed to — includes their email
    user {
      id
      email
      firstName
      lastName
      office { id name }
    }
  }
}

{ "accountId": "123", "id": "1001" }

Example response

{
  "data": {
    "amlCheck": {
      "id": "1001",
      "externalId": "ext-55",
      "status": "In Progress",
      "accountId": "123",
      "office": {
        "id": "7",
        "name": "West Coast Property Sales",
        "email": "[email protected]",
        "phone": "+61 8 9000 0000"
      },
      "user": {
        "id": "42",
        "email": "[email protected]",
        "firstName": "Alex",
        "lastName": "Agent",
        "office": { "id": "7", "name": "West Coast Property Sales" }
      }
    }
  }
}

Compliance Check Mutations (AML)

Write operations for compliance checks. All mutations accept an input object and return both an amlCheck payload and an errors array. Always check errors, even when the HTTP status is 200.

mutation CreateCheck(
  $accountId: ID!,  $contactId: ID!,  $contactType: String,  $entityType: String,
  $portalUrl: String,  $externalId: String,  $status: String,  $officeId: ID,  $note: String,
  $propertyIds: [ID!],  $appraisalIds: [ID!],  $attachments: [String!]
) {
  createAmlCheck(input: {
    accountId: $accountId,  contactId: $contactId,
    contactType: $contactType,  entityType: $entityType,  portalUrl: $portalUrl,
    externalId: $externalId,  status: $status,  officeId: $officeId,  note: $note,
    propertyIds: $propertyIds,  appraisalIds: $appraisalIds,  attachments: $attachments
  }) {
    amlCheck {
      id
      status
      source
      partnerApiClientId
      contactType
      entityType
      portalUrl
      externalId
      note
    }
    errors
  }
}

{
  "accountId": "123",
  "contactId": "456",
  "contactType": "seller",
  "entityType": "individual",
  "portalUrl": "https://aml-partner.example.com/verify/abc123",
  "externalId": "partner-check-abc123",
  "note": "Passport provided by applicant",
  "propertyIds": ["789"]
}

{
  "data": {
    "createAmlCheck": {
      "amlCheck": {
        "id": "1001",
        "status": "In Progress",
        "source": "Your Partner Client Name",
        "partnerApiClientId": "42",
        "contactType": "seller",
        "entityType": "individual",
        "portalUrl": "https://aml-partner.example.com/verify/abc123",
        "externalId": "partner-check-abc123",
        "note": "Passport provided by applicant"
      },
      "errors": []
    }
  }
}

mutation UpdateCheck(
  $accountId: ID!, $id: ID!, $note: String, $officeId: ID, $contactId: ID,
  $contactType: String, $entityType: String, $portalUrl: String, $externalId: String
) {
  updateAmlCheck(input: {
    accountId: $accountId,  id: $id,  note: $note,
    officeId: $officeId,    contactId: $contactId,
    contactType: $contactType,  entityType: $entityType,  portalUrl: $portalUrl,
    externalId: $externalId
  }) {
    amlCheck { id status note contactType entityType portalUrl externalId updatedAt }
    errors
  }
}

{ "accountId": "123", "id": "1001", "note": "Driver licence also verified on 2024-06-01" }

{
  "data": {
    "updateAmlCheck": {
      "amlCheck": {
        "id": "1001", "status": "In Progress",
        "note": "Driver licence also verified on 2024-06-01",
        "contactType": "seller",
        "entityType": "individual",
        "portalUrl": "https://aml-partner.example.com/verify/abc123",
        "externalId": "partner-check-abc123",
        "updatedAt": "2024-06-01T10:00:00Z"
      },
      "errors": []
    }
  }
}

mutation UpdateStatus($accountId: ID!, $id: ID!, $status: AmlCheckStatusEnum!) {
  updateAmlCheckStatus(input: {
    accountId: $accountId,  id: $id,  status: $status
  }) {
    amlCheck { id status statusUpdatedAt }
    errors
  }
}

{ "accountId": "123", "id": "1001", "status": "COMPLETED" }

{
  "data": {
    "updateAmlCheckStatus": {
      "amlCheck": {
        "id": "1001", "status": "Completed",
        "statusUpdatedAt": "2024-06-01T12:00:00Z"
      },
      "errors": []
    }
  }
}

mutation AttachFiles($accountId: ID!, $id: ID!, $urls: [String!]!) {
  attachFilesToAmlCheck(input: {
    accountId: $accountId,  id: $id,  urls: $urls
  }) {
    amlCheck {
      id
      attachments { id fileName downloadUrl status }
    }
    errors
  }
}

{
  "accountId": "123",
  "id": "1001",
  "urls": [
    "https://storage.example.com/passport-scan.pdf",
    "https://storage.example.com/drivers-licence.pdf"
  ]
}

{
  "data": {
    "attachFilesToAmlCheck": {
      "amlCheck": {
        "id": "1001",
        "attachments": [
          { "id": "201", "fileName": "passport-scan.pdf",   "downloadUrl": "https://...", "status": "uploaded" },
          { "id": "202", "fileName": "drivers-licence.pdf", "downloadUrl": "https://...", "status": "uploaded" }
        ]
      },
      "errors": []
    }
  }
}

mutation RemoveFile($accountId: ID!, $attachmentId: ID!) {
  destroyAmlAttachment(input: {
    accountId: $accountId,  attachmentId: $attachmentId
  }) {
    amlCheck {
      id
      attachments { id fileName downloadUrl }
    }
    errors
  }
}

{ "accountId": "123", "attachmentId": "201" }

{
  "data": {
    "destroyAmlAttachment": {
      "amlCheck": {
        "id": "1001",
        "attachments": [
          { "id": "202", "fileName": "drivers-licence.pdf", "downloadUrl": "https://..." }
        ]
      },
      "errors": []
    }
  }
}

mutation UpdateAssociations(
  $accountId: ID!, $id: ID!,
  $propertyIds: [ID!], $appraisalIds: [ID!]
) {
  updateAmlCheckListingAssociations(input: {
    accountId: $accountId,    id: $id,
    propertyIds: $propertyIds, appraisalIds: $appraisalIds
  }) {
    amlCheck {
      id
      status
      properties { id formattedAddress }
      appraisals  { id formattedAddress }
    }
    errors
  }
}

{ "accountId": "123", "id": "1001", "propertyIds": ["789", "790"] }

Webhooks

Register a single HTTPS endpoint and Eagle will POST a signed JSON payload whenever a compliance-check event occurs across any account linked to your partner client. No per-account setup is required.

All webhook mutations require the aml:write permission and a valid partner JWT. The optional accountIds argument on registerWebhook lets you validate that specific accounts are linked to your client, but the subscription itself is always global — every linked account will deliver events to your endpoint.

Supported event types

Payload shape

Each delivery sends a POST with Content-Type: application/json and the following headers:

Verifying the signature

Always verify X-Eagle-Signature before processing a payload. Compute sha256=HMAC-SHA256(signingSecret, rawRequestBody) and compare it to the header value using a constant-time comparison to prevent timing attacks.

# Ruby example
expected = "sha256=" + OpenSSL::HMAC.hexdigest("SHA256", signing_secret, request.raw_post)
secure   = ActiveSupport::SecurityUtils.secure_compare(expected, request.headers["X-Eagle-Signature"])
return head(:unauthorized) unless secure

# Node.js example
const crypto = require("crypto");
const expected = "sha256=" + crypto.createHmac("sha256", signingSecret).update(rawBody).digest("hex");
const received = req.headers["x-eagle-signature"];
const valid    = crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(received));
if (!valid) return res.status(401).send("Invalid signature");

mutation RegisterWebhook($url: String!, $eventTypes: [String!]!) {
  registerWebhook(input: {
    url: $url,
    eventTypes: $eventTypes
  }) {
    subscription {
      id
      url
      eventTypes
      enabled
    }
    signingSecret
    errors
  }
}

{
  "url": "https://your-server.example.com/eagle/webhooks",
  "eventTypes": ["aml_check.created", "aml_check.status_changed"]
}

{
  "data": {
    "registerWebhook": {
      "subscription": {
        "id": "1",
        "url": "https://your-server.example.com/eagle/webhooks",
        "eventTypes": ["aml_check.created", "aml_check.status_changed"],
        "enabled": true
      },
      "signingSecret": "a3f8...c2d1",
      "errors": []
    }
  }
}

mutation UpdateWebhook($id: ID!, $url: String, $eventTypes: [String!], $enabled: Boolean) {
  updateWebhook(input: {
    id: $id,
    url: $url,
    eventTypes: $eventTypes,
    enabled: $enabled
  }) {
    subscription {
      id
      url
      eventTypes
      enabled
    }
    errors
  }
}

{ "id": "1", "enabled": false }

mutation DeleteWebhook($id: ID!) {
  deleteWebhook(input: { id: $id }) {
    errors
  }
}

{ "id": "1" }

mutation RotateWebhookSecret($id: ID!) {
  rotateWebhookSecret(input: { id: $id }) {
    signingSecret
    errors
  }
}

{ "id": "1" }

Error handling

Errors appear in two places: a top-level errors array for request-level failures, and a per-mutation errors array inside the response payload for business-logic failures. Always handle both.

Top-level GraphQL errors

Mutation payload errors

Error response shape

{
  "data": {
    "createAmlCheck": {
      "amlCheck": null,
      "errors": ["Contact not found"]
    }
  }
}

Quick reference

• Get a token via POST /api/v3/partner_graphql/token with HTTP Basic auth. Tokens last 24 hours.
• Send all operations to POST /api/v3/partner_graphql with Authorization: Bearer TOKEN.
• Include accountId on every query and mutation — it must be linked to your client.
• Use partnerPing to test connectivity without loading data.
• List queries are paginated: use first + after, max 50 records per page.
• For mutations, always check the errors array even on HTTP 200.
• Store source and partnerApiClientId from compliance check create responses — they cannot be changed later.
• Do not link compliance checks to properties with a settled/sold status.
• Compliance status enum: send UPPER_SNAKE_CASE, receive title case.

Resources

Standard Eagle GraphQL API (agent credentials, full schema):

Eagle GraphQL API documentation →

Postman collection — import, set client_id, client_secret, and account_id, then run Get Partner Token:

Eagle_Partner_GraphQL.postman_collection.json ↓