CabRank API Documentation

About the API

CabRank is a legal referral and client-intake platform for law firms: firms claim new client matters, complete client instruction sheets and costs agreements, and finalise each matter with documents issued to the client and the claiming lawyer. The CabRank API is the platform’s programmatic surface for workflow automation — it lets a firm’s automation tooling receive each finalised matter the moment finalisation completes, retrieve sample records for building field mappings, and record the identifier the firm’s practice-management system assigned. The official CabRank integration on Zapier is built entirely on this API.

Base URL: https://api.cabrank.legal/zapier/v1

The table above is the API’s entire surface: five REST endpoints and one webhook event, each documented in full below. CabRank has no other public API endpoints, and a CabRank API key authenticates nothing beyond what is on this page. Other systems CabRank operates internally — payment processing, telephony, scheduled jobs — are private infrastructure, are not part of this API, and are not reachable with an API key. The API is not a general-purpose data API: it cannot read, list or search matters beyond the sample endpoint described below.

Conventions and versioning

• All endpoints are HTTPS-only. Requests and responses are JSON (UTF-8).
• The API version is carried in the path (/zapier/v1). Breaking changes are only ever introduced under a new version path; the current version is v1.
• Additive, non-breaking changes (new payload fields, new endpoints) may appear within v1 and are recorded in the changelog. Webhook consumers should tolerate unknown fields.
• Payload fields that were not captured for a matter are null rather than omitted, so field mappings never break.

Authentication

Every request is authenticated with a per-firm API key sent in the X-API-Key header. The key identifies your firm; everything the key can see or touch is scoped to that firm alone.

GET /zapier/v1/me HTTP/1.1
Host: api.cabrank.legal
X-API-Key: <your firm's CabRank API key>

CabRank issues your firm’s key when your connection is set up — contact admin@platfirm.ai. In the Zapier editor, you supply the key once when creating the CabRank connection; Zapier stores it securely and attaches it to every request.

Requests without a key, or with an unrecognised key, receive 401 with a JSON body of the form { "error": "unauthenticated", "message": "..." }. Revoking a firm’s key immediately disables its connection; keys can be reissued at any time via admin@platfirm.ai.

Endpoints

GET /me

Connection test. Returns the firm the key belongs to; Zapier uses firm_name to label the connection.

200 OK
{ "ok": true, "firm_id": "your-firm-id", "firm_name": "Your Firm Name" }

Errors: 401 unauthenticated for a missing, malformed or unrecognised key.

POST /hooks

Subscribes a webhook. Called automatically by Zapier when a Zap using the New Finalised Matter trigger is switched on. target_url must be a https://hooks.zapier.com/ URL; event is optional and defaults to matter.finalized, currently the only event.

POST /zapier/v1/hooks
{ "target_url": "https://hooks.zapier.com/hooks/catch/...", "event": "matter.finalized" }

200 OK
{ "id": "3f6b6c9e-...", "ok": true }

Re-subscribing an identical hook returns the existing subscription with "deduped": true rather than creating a duplicate, so subscription IDs are stable.

Errors: 400 bad_request when target_url is missing or not a hooks.zapier.com URL, or when event is not a recognised event name.

DELETE /hooks?id=<subscription id>

Removes a webhook subscription. Called automatically by Zapier when the Zap is switched off. The ID may also be sent in a JSON body. Deletion is scoped to your firm — a key can never remove another firm’s subscription. Returns { "ok": true }.

Errors: 400 bad_request when no valid subscription ID is supplied.

GET /samples

Returns up to three of your firm’s most recently finalised matters, shaped identically to the live webhook payload, so field mappings built in the Zap editor against test data keep working on live events. If your firm has no finalised matters yet, one canned sample record is returned. Document links are null in samples.

200 OK
[ { "event": "matter.finalized", "matter_id": "...", "central_id": "...", ... } ]

POST /mark-synced

The sync receipt. After your workflow creates the matter in your practice-management system, this endpoint records the assigned ID back on the CabRank matter and flips its sync status to synced. The matter must belong to your firm, otherwise 404.

POST /zapier/v1/mark-synced
{ "matter_id": "<CabRank matter UUID>", "pms_matter_id": "<your system's ID>", "pms_type": "leap" }

200 OK
{ "ok": true, "matter_id": "...", "pms_matter_id": "...", "pms_sync_status": "synced", "pms_type": "leap" }

pms_type is optional; accepted values are clio, leap, smokeball and actionstep.

Errors: 400 bad_request when matter_id or pms_matter_id is missing, or pms_type is not an accepted value; 404 not_found when the matter does not exist or does not belong to your firm.

Webhook delivery — matter.finalized

• When a matter is finalised, CabRank sends one POST with a JSON payload to each of the firm’s subscribed webhook URLs.
• The event fires after finalisation completes durably, and at most once per matter — a webhook can never receive a matter that isn’t finalised, and never receives the same matter twice.
• A 410 Gone response removes the subscription, per Zapier’s REST hook convention for switched-off Zaps.
• Document links in the payload are time-limited secure URLs that expire 22 hours after the event fires — long enough to cover Zapier’s automatic replay window. Workflows should still fetch documents promptly; the claiming lawyer also always receives the documents by email, independent of any webhook.

Payload reference — matter.finalized

All fields are strings or null. Fields that were not captured for a matter are null rather than omitted, so mappings never break.

Errors

Errors return a JSON body of the form { "error": "<code>", "message": "<human-readable detail>" }.

Changelog

• 8 August 2026 — POST /mark-synced now accepts clio as a pms_type value (previously leap, smokeball and actionstep only).
• 6 August 2026 — Document links in the matter.finalized payload are now valid for 22 hours (previously two hours), covering Zapier’s automatic-replay window.
• 6 August 2026 — Documentation expanded into the complete API reference (API surface table, conventions and versioning, per-endpoint error shapes, changelog). No API changes.
• 28 July 2026 — v1 initial release: GET /me, POST /hooks, DELETE /hooks, GET /samples, POST /mark-synced, and the matter.finalized webhook event.

Data handling

The webhook carries confirmed intake information for a matter your firm has already claimed, plus time-limited links to that matter’s engagement documents. Your practice-management login never passes through CabRank — it is held by Zapier under your firm’s own authorisation. CabRank’s full security posture, sub-processor disclosure and data-deletion commitments are documented on the Security page and in the Privacy Policy.

Getting access

The CabRank integration is published in Zapier’s app directory — search for CabRank when building a Zap; no invitation is needed. All you need is your firm’s CabRank API key, which a firm administrator can generate under Admin → Storage → PMS Connection, or request from admin@platfirm.ai.

Connecting your firm’s practice management system? The step-by-step guide is at Connect your practice management system.

Platfirm AI Pty Ltd · ACN 679 859 744 · Level 17 & 18, International Tower 3, 300 Barangaroo Avenue, Sydney NSW 2000