tag: BETA

This webservice is used to submit a seller property commercialization request from mobile applications. It allows property owners to submit their properties for sale or rent with detailed information and optional file attachments (images and PDFs).

The owner's request is registered in the agency's Mapaprop account (the one that owns the token): it is saved as a contact in the CRM and the agency is notified by email with the attachments. The destination account is resolved from the token, it is not sent as a parameter.

Resource URL

https://mapaprop.app/api/action/express-v1/seller-submissions

Authentication

This endpoint requires OAuth2 authentication. You must include a valid Bearer token in the Authorization header.

Authorization: Bearer {your-oauth2-token}

The customerId is automatically extracted from the authenticated token. Do not include it in the request body.

Parameters

Required Parameters

Optional Parameters - Contact Information

Optional Parameters - Property Details

Optional Parameters - File Attachments

Optional Parameters - Mobile App Metadata

File Upload Format

Images and PDFs must be uploaded as Base64-encoded Data URLs:

Image format:

data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJ...

PDF format:

data:application/pdf;base64,JVBERi0xLjQKJcOkw7zDtsKBw4XDqsOPDQoxIDAgb2Jq...

Supported image types:

• image/jpeg
• image/png
• image/gif
• image/webp

File size limits:

• Maximum per file: 2MB
• Maximum total bandwidth: 10MB per hour

Security:

• Files are validated using magic number validation (not just MIME type)
• All files are scanned for security threats
• Files are uploaded to secure S3 storage

Sample Request

POST /api/action/express-v1/seller-submissions HTTP/1.1
Host: mapaprop.app
Content-Type: application/json
Authorization: Bearer {access_token}

{
    "websiteId": 869,
    "name": "Juan Carlos Rodriguez",
    "email": "juan.rodriguez@gmail.com",
    "phone": "+54 11 4567-8901",
    "contactHours": "Lunes a Viernes de 9 a 18hs",
    "propertyType": "Casa",
    "propertyOperation": "Venta",
    "propertyAddress": "Av. Corrientes 1234",
    "propertyZone": "Barrio Norte",
    "propertyLandArea": "250",
    "propertyBuildingArea": "180",
    "propertyPrice": "150000000",
    "propertyCurrency": "ARS",
    "propertyRooms": "3",
    "propertyBathrooms": "2",
    "propertyDescription": "Hermosa casa de 3 plantas con jardín y garage.",
    "propertyListed": "false",
    "propertyValuation": "true",
    "image": "data:image/png;base64,iVBORw0KGgo...",
    "pdf": "data:application/pdf;base64,JVBERi0xLjQ...",
    "platform": "iOS",
    "appVersion": "2.5.1",
    "userAgent": "Mozilla/5.0 (iPhone; CPU iPhone OS 14_0 like Mac OS X)",
    "ip": "181.47.123.45",
    "referer": "https://www.mapaprop.com/publicar-propiedad",
    "domain": "www.mapaprop.com",
    "url": "https://www.mapaprop.com/publicar-propiedad/formulario"
}

Response

The JSON response will tell you if the seller submission was successful and provide details about the created contact.

Success Response

Error Response

Sample Response - Success

{
    "error": false,
    "message": "Seller commercialization request submitted successfully",
    "contactId": 1065875,
    "websiteId": 869,
    "processingTimeMs": 5215
}

Sample Response - Errors

Invalid website ownership:

{
    "error": true,
    "message": "Website not found or does not belong to customer",
    "code": "NOT_FOUND"
}

Rate limit exceeded:

{
    "error": true,
    "message": "Too many seller submissions. Please try again later.",
    "code": "RATE_LIMIT_EXCEEDED"
}

Invalid file format:

{
    "error": true,
    "message": "Invalid file format. Only JPEG, PNG, GIF, WebP images and PDF documents are allowed.",
    "code": "INVALID_FILE"
}

Missing required field:

{
    "error": true,
    "message": "Name is required and must be between 3 and 100 characters",
    "code": "INVALID_INPUT"
}

Spam detected:

{
    "error": true,
    "message": "Spam detected",
    "code": "SPAM_DETECTED"
}

Rate Limiting

This endpoint is rate-limited to prevent abuse:

• Request limit: 10 requests per hour per customer
• Bandwidth limit: 10MB per hour per customer

When rate limit is exceeded, you will receive:

{
    "error": true,
    "message": "Too many seller submissions. Please try again later.",
    "code": "RATE_LIMIT_EXCEEDED"
}

Security Features

Spam Detection

All submissions are checked for spam using Akismet integration in production environment. Submissions flagged as spam are logged but not blocked automatically.

File Security

• Magic number validation: Files are validated by their actual content, not just MIME type
• File size limits: 2MB per file, 10MB total bandwidth per hour
• Supported formats: Only whitelisted image and PDF formats accepted
• Secure storage: Files uploaded to encrypted S3 buckets

Input Validation

• All text fields are sanitized and validated
• Email addresses must be valid RFC-compliant format
• Phone numbers are validated for format
• SQL injection prevention through prepared statements
• XSS prevention through template escaping

What Happens After Submission

1. Contact Creation: A new contact is created in the CRM with type "SELLER"
2. File Storage: Images and PDFs are uploaded to secure S3 storage
3. Email Notification: An email is queued (via SQS) and sent to the customer with:
   • All property details
   • Attached files (image and PDF)
   • Contact information
   • Submission metadata (platform, app version, timestamp)
4. Statistics: Event is logged with detailed metadata for analytics
5. Audit Trail: Complete audit log is created for compliance

Error Codes

Best Practices

1. Always include OAuth2 token: The endpoint requires authentication
2. Validate on client side: Check required fields before sending
3. Compress images: Optimize images before Base64 encoding to stay under 2MB limit
4. Handle rate limits: Implement exponential backoff if rate limited
5. Track app version: Always send platform and appVersion for analytics
6. Provide accurate IP: Send the real user IP for spam detection accuracy
7. Use HTTPS: Always use secure connection in production

Integration Notes

• customerId is automatic: Do not include customerId in the request body; it's extracted from the OAuth2 token
• websiteId ownership: The endpoint validates that the websiteId belongs to the authenticated customer
• DEV vs PROD: Spam detection is bypassed in development environment but active in production
• Email redirect in DEV: In development, emails are redirected to info@mapaprop.com instead of the customer email

Related Documentation

For the complete practical workflow of how property capture works in the system, see:

Property Capture - Sell (Practical Flow)

Version History

API Version: 1.0 Last Updated: 2025-10-22 Status: Production Ready