Getting Help

If a request fails, behaves unexpectedly or you have a question about the API, this guide tells you where to reach out and what to send us.
The more context you give us, the faster we can help.
You can write to us in German or English.

Where to Address Your Request

Discussions

The Discussions area is public.
Strip any personal data, customer names, IDs that identify a customer, and secrets such as access tokens or passwords before posting.
If your question can't be asked without such information, contact support instead.

facilioo Support

Support can look into the data of a particular customer.
Name the customer (property management company) your request is about.
This is limited to official partners and parties that already work with facilioo and the customer.
If you don't work with facilioo yet, ask the customer to contact support, we only accept such requests directly in exceptional cases.

For data migrations and large-scale issues, reach out before trying to repair the data via the API yourself.
Some issues can be fixed far more easily and safely on our side, and some can't be fixed via the API at all.

Data Privacy Breaches and Security Vulnerabilities

Report a data privacy breach or a security vulnerability to support immediately, even if you are unsure whether it is one.
We will then start the appropriate process.
Never report them in the Discussions area.

What to Provide

Give us as much context as possible, but never send access tokens, refresh tokens, passwords or other secrets.
Avoid sending large files, such as log dumps or exports, and send the relevant excerpt instead.

📘

Act Quickly

Our logs and traces are only stored for a limited time.
Report failed requests promptly, otherwise we might not be able to investigate them anymore.

Context

• What you want to achieve, and which documentation you followed.
• The environment: production, staging or development.
• Whether the issue always occurs, only sometimes, or since when, and whether something changed on your side at that time.
• The IDs of the entities involved, e.g. the property or process ID.

Payload of the Access Token

Send the decoded payload of the access token you used.
It lets us identify the customer and the account behind the request, so we can replicate it.
Only send the payload, never the token itself.

The best way is to decode the payload locally, so the token never leaves your machine, e.g. with Python:

python3 -c "import sys, base64, json; p = sys.argv[1].split('.')[1]; print(json.dumps(json.loads(base64.urlsafe_b64decode(p + '=' * (-len(p) % 4))), indent=2))" "$ACCESS_TOKEN"

Or with Node.js:

node -e "console.log(JSON.parse(Buffer.from(process.argv[1].split('.')[1], 'base64url')))" "$ACCESS_TOKEN"

An easier way is pasting the token into jwt.io, but we don't recommend this for access tokens of the production environment.

Request

Send the complete request, ideally as a cURL command, including:

• the method and full path,
• all query parameters,
• all additional headers,
• the request body.

curl -X PATCH 'https://api.facilioo.de/api/processes/42' \
  -H 'Authorization: Bearer <removed>' \
  -H 'Content-Type: application/json' \
  -d '{"title": "Water damage in the basement"}'

Response

• The HTTP status code.
• The response headers.
• The response body you received, anonymized where necessary.
• The response body you expected instead.

Time of the Request

Send the time the request was made, including the time zone, e.g. 2026-11-07T14:32:10+01:00.
It lets us find the request in our logs.

Trace ID and Request ID

If the response contains a trace ID or request ID, e.g. in the headers X-Trace-Id and X-Request-Id or as traceId in the body of an error response, send it.
These IDs lead us directly to the logs and traces of your request.

Webhooks

If a webhook wasn't delivered or delivered unexpected data, send the ID of the webhook and the time the event should have been triggered.