Real Estate: How to Share Exposés Securely and Spot Serious Buyers

Upload the exposé privately, then mint a link for every inquiry — the listing stays in your hands, and every reader arrives with a name:

curl -X POST https://apdf.io/api/docs \
  -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" \
  --data-urlencode "file=https://your-site.example/expose-lindenstrasse-12.pdf" \
  --data-urlencode "name=Exposé — Lindenstraße 12" \
  -d "is_public=0"

curl -X POST https://apdf.io/api/docs/2b55f-d1f11-042a8/links \
  -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" \
  --data-urlencode "name=Familie Arslan" \
  --data-urlencode "email=arslan@familie.example"

The reply to an inquiry is now a personal URL instead of an attachment — same email, better exposé: it opens in the browser on any device, and it can be taken back.

A few days after sending, the sessions list reads like a buyer ranking:

curl -s "https://apdf.io/api/docs/2b55f-d1f11-042a8/analytics/sessions" \
  -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" |
jq -r '.data[] | "\(.recipient.name): \(.pages_viewed)/6 pages · \(.total_duration_ms)ms · \(.created_at)"'

Familie Arslan: 3/6 pages · 245000ms · 2026-07-21 21:18:20.000
Stefan Brauer:  2/6 pages · 22000ms  · 2026-07-20 15:17:20.000
Carola Nguyen:  6/6 pages · 133000ms · 2026-07-20 10:43:20.000
Familie Arslan: 6/6 pages · 265000ms · 2026-07-19 19:00:20.000
Jens Petersen:  2/6 pages · 32000ms  · 2026-07-19 12:17:20.000

• Jens flipped through the photos on his phone for half a minute — a looker.
• Stefan peeked at the price page and left after 22 seconds — priced out, no follow-up needed.
• Carola made one careful full pass — warm, worth a viewing invitation.
• The Arslans appear twice — a full evening read, then a return visit two days later. Re-opens are the strongest intent signal a document can send.
• Mona never opened — check the email landed before writing her off.

The session detail turns “they came back” into “here's what they came back for”:

GET /api/docs/2b55f-d1f11-042a8/analytics/sessions/8GkCUcbumRPXOSOd

"pages": [
    { "page": 1, "views": 0, "duration_ms": 0,      "viewed": false },
    { "page": 2, "views": 1, "duration_ms": 30000,  "viewed": true },
    { "page": 3, "views": 1, "duration_ms": 95000,  "viewed": true },
    { "page": 4, "views": 0, "duration_ms": 0,      "viewed": false },
    { "page": 5, "views": 1, "duration_ms": 120000, "viewed": true },
    { "page": 6, "views": 0, "duration_ms": 0,      "viewed": false }
]

No cover, no location fluff — the return visit went straight to page 3 (floor plan, 95 seconds) and page 5 (price & running costs, 2 minutes). Someone measuring furniture against a floor plan and re-reading the Hausgeld isn't browsing — call them first, and walk into the viewing knowing exactly what they'll ask about.

The day the notary appointment is booked, every circulating exposé copy becomes a liability — old asking prices have a way of resurfacing. One loop revokes the whole prospect list:

API="https://apdf.io/api/docs/2b55f-d1f11-042a8/links"
curl -s "$API" -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" |
jq -r '.data[] | select(.is_active) | .token' |
while read -r token; do
  curl -s -X POST "$API/$token/deactivate" \
    -H "Authorization: Bearer $API_TOKEN" -H "Accept: application/json" > /dev/null
  echo "Revoked $token"
  sleep 1
done

Every link now lands on a neutral 403 page — no document, not even its name — while your reading history stays intact for the next listing's outreach list. The revocation tutorial has the full lifecycle, including restoring a link if the sale falls through.