Logo
Apdf tutorials August 2026 5 min read

Real Estate: How to Share Exposés Securely and Spot Serious Buyers

Ten people request the exposé; one of them is a buyer. The other nine are neighbors, dreamers and portal-scrollers — and until viewing day you can't tell them apart, because a PDF attachment reports nothing back and keeps circulating long after the sale closes.

Send each prospect a personal tracked link instead, and the exposé starts answering the only question that matters: who's calculating, and who's just looking?

What you'll build
One listing, five prospects, and a reading pattern that names the serious buyer before anyone picks up the phone: The Arslans came back at 21:18 — 95s on the floor plan, 2 minutes on the price page
Everything in this tutorial works on the free plan
1

One exposé, one link per prospect

Upload the exposé privately, then mint a link for every inquiry — the listing stays in your hands, and every reader arrives with a name:

curl -X POST https://apdf.io/api/docs \
  -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" \
  --data-urlencode "file=https://your-site.example/expose-lindenstrasse-12.pdf" \
  --data-urlencode "name=Exposé — Lindenstraße 12" \
  -d "is_public=0"

curl -X POST https://apdf.io/api/docs/2b55f-d1f11-042a8/links \
  -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" \
  --data-urlencode "name=Familie Arslan" \
  --data-urlencode "email=arslan@familie.example"

The reply to an inquiry is now a personal URL instead of an attachment — same email, better exposé: it opens in the browser on any device, and it can be taken back.

2

Watch the week's reading

A few days after sending, the sessions list reads like a buyer ranking:

curl -s "https://apdf.io/api/docs/2b55f-d1f11-042a8/analytics/sessions" \
  -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" |
jq -r '.data[] | "\(.recipient.name): \(.pages_viewed)/6 pages · \(.total_duration_ms)ms · \(.created_at)"'

Familie Arslan: 3/6 pages · 245000ms · 2026-07-21 21:18:20.000
Stefan Brauer:  2/6 pages · 22000ms  · 2026-07-20 15:17:20.000
Carola Nguyen:  6/6 pages · 133000ms · 2026-07-20 10:43:20.000
Familie Arslan: 6/6 pages · 265000ms · 2026-07-19 19:00:20.000
Jens Petersen:  2/6 pages · 32000ms  · 2026-07-19 12:17:20.000
  • Jens flipped through the photos on his phone for half a minute — a looker.
  • Stefan peeked at the price page and left after 22 seconds — priced out, no follow-up needed.
  • Carola made one careful full pass — warm, worth a viewing invitation.
  • The Arslans appear twice — a full evening read, then a return visit two days later. Re-opens are the strongest intent signal a document can send.
  • Mona never opened — check the email landed before writing her off.
3

Confirm it page by page

The session detail turns “they came back” into “here's what they came back for”:

GET /api/docs/2b55f-d1f11-042a8/analytics/sessions/8GkCUcbumRPXOSOd

"pages": [
    { "page": 1, "views": 0, "duration_ms": 0,      "viewed": false },
    { "page": 2, "views": 1, "duration_ms": 30000,  "viewed": true },
    { "page": 3, "views": 1, "duration_ms": 95000,  "viewed": true },
    { "page": 4, "views": 0, "duration_ms": 0,      "viewed": false },
    { "page": 5, "views": 1, "duration_ms": 120000, "viewed": true },
    { "page": 6, "views": 0, "duration_ms": 0,      "viewed": false }
]

No cover, no location fluff — the return visit went straight to page 3 (floor plan, 95 seconds) and page 5 (price & running costs, 2 minutes). Someone measuring furniture against a floor plan and re-reading the Hausgeld isn't browsing — call them first, and walk into the viewing knowing exactly what they'll ask about.

4

Sold? Turn the lights off

The day the notary appointment is booked, every circulating exposé copy becomes a liability — old asking prices have a way of resurfacing. One loop revokes the whole prospect list:

API="https://apdf.io/api/docs/2b55f-d1f11-042a8/links"
curl -s "$API" -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" |
jq -r '.data[] | select(.is_active) | .token' |
while read -r token; do
  curl -s -X POST "$API/$token/deactivate" \
    -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" > /dev/null
  echo "Revoked $token"
  sleep 1
done

Every link now lands on a neutral 403 page — no document, not even its name — while your reading history stays intact for the next listing's outreach list. The revocation tutorial has the full lifecycle, including restoring a link if the sale falls through.

Where to go from here

The same signals, wired deeper into your day.

Ready to see who reads?