Developers · YayNo

Verification rules stay the same. Only a per-job invite token, an onsite QR scan, or an uploaded receipt, invoice or contract counts as a verified review. A static poster QR (/r/{slug}) takes a customer to the review page; it does not by itself mark the visit verified.

Stable URL patterns

Other software can generate these without calling the API, except per-job invites which must be minted so they stay single-use and signed.

`/r/{business_slug}`	Static poster QR. Print once; point it at this business’s review page. Example: `https://getyayno.com/r/{business_slug}`. It does not verify the visit.
`/r/{business_slug}?v=yay`	Green Yay card. Opens the review form with Yay selected. The customer can switch. Verification is unchanged.
`/r/{business_slug}?v=no`	Red No card. Opens the review form with No selected. Any other `v` value is ignored.
`/i/{short_code}`	Per-job invite (single-use or expiring). Returned by `POST /api/v1/invites`.
`/qr/{slug}.png?size=256`	Printable PNG of the static QR. Also `.svg`.
`/embed/{slug}`	Iframe widget. Styles: `badge`, `card`, `carousel`. Themes: `light`, `dark`, `auto`. `/badge/{slug}.svg` is an image. `/widget/{slug}.json` is the cached score.

Authentication

Create a key in the owner dashboard. The raw key is shown once and stored as a SHA-256 hash. Send it as:

Authorization: Bearer ynk_live_…

Or the X-API-Key header. Keys are scoped to one business. Rate limit: 120 requests/minute/key. Errors are JSON: {"error":{"code":"unauthorized","message":"…","status":401}}.

Endpoints

GET /api/v1/industries and GET /api/v1/categories
GET /api/v1/businesses (search, pagination) and GET /api/v1/businesses/{id_or_slug}
GET /api/v1/businesses/{id_or_slug}/reviews — published and disputed reviews, read-only. A dispute does not drop a review from this list.
POST /api/v1/reviews/{id}/disputes — business key, category + explanation + attest: true. Puts the review in the moderation queue. Does not hide it.
POST /api/v1/reviews/{id}/removal — 403 for a business API key or anyone who did not write the review. Only the author's signed-in session can withdraw it.
GET /api/v1/businesses/{id_or_slug}/claim — claim status
GET /api/v1/businesses/{id_or_slug}/qr?format=png|svg&size=256 — printable QR
POST /api/v1/invites — trigger a single-use verified invite after payment. Body: external_ref (job, invoice or order id), optional amount, currency, transaction_date, optional customer, attest=true. Send an Idempotency-Key header so retries don't mint a second invite. Returns the link, short URL, and QR as PNG and SVG.
POST /api/v1/invites/from-transaction — the same, with the transaction fields required in the schema.
POST /api/v1/integrations/{square|quickbooks|jobber|shopify|stripe|zapier}/webhook — stub connectors that parse a typical payment webhook and mint an invite. Sample payloads are in docs/integrations/. No live keys; this demo does not claim a partnership.
POST /api/v1/integrations/zapier — a generic Zapier-style webhook: {external_id, amount, date, customer}.
GET /api/v1/invites and GET /api/v1/invites/{id}
POST /api/v1/invites/import — CSV of customers or jobs
GET /api/v1/export?format=json|csv
GET/POST /api/v1/webhooks — events: review.created, review.published, invite.used, business.claimed, dispute.opened, dispute.decided. Signed with HMAC-SHA256, retried with backoff, delivery log.
GET /api/v1/openapi.json — this specification

Full examples (curl, JavaScript, Python) and a Zapier/Make-style mapping: see docs/INTEGRATIONS.md in the repo. Field-service tools such as Jobber, ServiceTitan or Housecall Pro can call the same invite API — this demo does not claim a partnership with any of them.

Trigger an invite after payment

POS, invoicing, and field-service apps can mint a single-use verified invite when a payment clears. Send the same JSON your system already has: an external id, the amount and date, and the customer’s contact. Retries with the same Idempotency-Key return the original invite; a different body with the same key returns 409.

curl -X POST /api/v1/invites \
  -H "Authorization: Bearer ynk_live_…" \
  -H "Idempotency-Key: job-1042-paid" \
  -H "Content-Type: application/json" \
  -d '{"business_id":1,"external_ref":"JOB-1042","amount":150.00,"currency":"USD",
       "transaction_date":"2026-11-12","customer":{"name":"Demo Customer","email":"a@demo.test"},
       "attest":true}'

Stubs for Square, QuickBooks, Jobber, Shopify and Stripe webhooks, plus a Zapier-style generic hook, live at POST /api/v1/integrations/{provider}/webhook. They parse a typical payload and call the same invite path. This is a private demo — no live keys, and YayNo is not a partner of those companies.

Website embed

The widget shows the public Yay score, the count of verified reviews, and — in the carousel — the latest verified reviews by date. A business cannot choose which reviews appear. It is included with Pro, Plus, and Enterprise. On the Free plan it is $9 a month. Without it, the snippet shows a Review us on YayNo link. GET https://getyayno.com/widget/{business_slug}.json is cached and only readable in a browser from websites the business has listed.

<div class="yayno-reviews" data-slug="sample-diner" data-style="card" data-theme="light"></div>
<script async src="https://getyayno.com/static/widget.js" data-yayno-slug="sample-diner" data-yayno-style="card" data-yayno-theme="light"></script>

Or an iframe. Copy either one from the owner widget page.

Directory data licenses

Business listings may be imported from Overture Maps Places (CDLA-Permissive-2.0, Apache 2.0 for Foursquare-sourced rows, CC0 for AllThePlaces) or, separately, from OpenStreetMap (ODbL). If you use or redistribute Foursquare-sourced listings through this API, Apache 2.0 requires a copy of the license, a notice of changes, and the Foursquare NOTICE. Those texts, and a full source list, are on the data sources page and in NOTICE.txt. YayNo is not endorsed by these providers.