CoStar

Before touching Bubble's API Connector, your first action is contacting CoStar's API team at api.costar.com. There is no alternative path — no developer portal, no trial key, no self-serve registration. CoStar's data is licensed commercial data, and API access is only granted to organizations that have (or are establishing) a CoStar data subscription. When you reach out, be prepared to provide: - Your intended use case (custom brokerage tool, client-facing analytics portal, internal deal pipeline, etc.) - The CoStar products you are licensed for or planning to license (CoStar Suite, CoStar COMPS, LoopNet, etc.) - Your organization's name and existing CoStar account reference (if applicable) - How you plan to display and store CoStar data (describe your Bubble application architecture at a high level) CoStar's sales and technical teams will review your use case against their data redistribution terms. Two frequent approval blockers to be aware of: (1) applications that would show CoStar data to unauthenticated or non-licensed users are typically declined, and (2) use cases that involve re-selling or redistributing CoStar data through your platform require a separate data redistribution agreement at higher cost. While waiting for approval (which can take from a few business days to several weeks), proceed immediately to Step 2 to build your Bubble prototype. The waiting period is not idle time — you can build, test, and validate your entire Bubble application structure using ATTOM Data as a stand-in.

ATTOM Data Solutions (attomdata.com) provides property data — ownership, valuations, sales history, AVM estimates — via a self-serve REST API with instant developer portal access. It is not CoStar (no commercial lease data or submarket analytics), but it covers enough residential and commercial property data to validate your Bubble application's structure before CoStar credentials arrive. Go to attomdata.com, create a developer account, and generate an API key. The key is passed as an X-APIKey header on every request — exactly the same pattern you will use for CoStar. In Bubble, go to Plugins → API Connector → Add another API. Name it 'Property Data' (use a generic name, not 'ATTOM', so you do not need to rename it when CoStar credentials arrive). Configure: - Base URL: https://api.gateway.attomdata.com/propertyapi/v1.0.0 - Shared header Key: X-APIKey, Value: [your ATTOM key], mark as Private - Shared header Key: Accept, Value: application/json (static) Add a call named 'Property Search'. Method: GET. URL path: /property/address. Add query parameters: address1 (dynamic), address2 (dynamic — city/state), postalcode (dynamic). Click Initialize call with a real US address to detect the response fields. Build your entire Bubble UI — property search form, results Repeating Group, detail popup, comparables panel — using ATTOM's response structure. ATTOM's field names will differ from CoStar's, but the workflow logic and UI layout transfer directly. When CoStar credentials arrive, you will update the base URL, authentication header, and API call endpoints — the Bubble data model and UI remain. Create the Bubble data types you will need: Property (address, property_type, building_sf, year_built, last_sale_price, cache_expires_at), Comparable (property_id, transaction_date, price_per_sf, lease_rate, transaction_type), SubmarketStat (submarket, property_type, vacancy_rate, avg_asking_rent, report_date).

1// ATTOM Data API Connector (prototype configuration)
2{
3  "method": "GET",
4  "url": "https://api.gateway.attomdata.com/propertyapi/v1.0.0/property/address",
5  "headers": {
6    "X-APIKey": "<your_attom_key_private>",
7    "Accept": "application/json"
8  },
9  "params": {
10    "address1": "<dynamic_street_address>",
11    "address2": "<dynamic_city_state>",
12    "postalcode": "<dynamic_zip>"
13  }
14}
15
16// When CoStar credentials arrive, update to:
17// Base URL: https://api.costar.com (verify with CoStar onboarding)
18// Header: [CoStar-specified auth header name]: [CoStar API key]

Once CoStar's technical onboarding team provides your credentials and endpoint documentation, configure the production API Connector. The exact authentication mechanism varies by CoStar product — verify all of the following with your CoStar technical contact before configuration: - The API base URL (typically https://api.costar.com, but may include a version path or regional endpoint) - The authentication header name (may be 'X-Api-Key', 'Authorization', or a CoStar-specific header name) - Whether authentication uses a static API key, a short-lived token requiring exchange, or OAuth - Rate limits for your contracted tier - Which endpoints are available under your specific license (property search, comparables, market analytics, and/or tenant data each require separate licensed access) In Bubble's API Connector, update (or create) the 'Property Data' API: - Update the base URL to CoStar's production endpoint - Replace the X-APIKey ATTOM header with CoStar's authentication header (marked Private — this is non-negotiable for licensed CRE data) - Update each API call's URL path to CoStar's endpoint paths (provided in CoStar's onboarding documentation) - Update the query parameter names and body field names to match CoStar's API specification Before going live, re-initialize each API Connector call with CoStar credentials to let Bubble detect the new response field structure. CoStar responses may be structured differently from ATTOM's — update your Bubble data types and field mappings to match. Pay particular attention to pagination parameters: CoStar's property search results are typically paginated, and calling without page/size parameters may return unexpected result counts. Your CoStar technical contact will document the pagination scheme.

1// CoStar API Connector configuration (structure — verify exact values with CoStar)
2{
3  "method": "GET",
4  "url": "https://api.costar.com/<endpoint_path_per_costar_docs>",
5  "headers": {
6    "<CoStar_auth_header_name>": "<your_costar_credential_private>",
7    "Accept": "application/json"
8  },
9  "params": {
10    "submarket": "<dynamic_submarket_filter>",
11    "propertyType": "<dynamic_property_type>",
12    "buildingSizeMin": "<dynamic_min_sf>",
13    "buildingSizeMax": "<dynamic_max_sf>",
14    "pageNumber": "<dynamic_page>",
15    "pageSize": "25"
16  }
17}

This step is not optional — it is a condition of CoStar's data licensing terms. CoStar's license agreement prohibits displaying or storing licensed data in ways accessible to unauthenticated users. In Bubble, this is enforced through privacy rules on every data type that stores CoStar property records. Go to Data tab in your Bubble editor. Click on each data type that stores CoStar data (Property, Comparable, SubmarketStat, or whatever you named them). Click the Privacy tab at the top of the data type editor. Create a privacy rule: - Rule name: 'Authenticated Users Only' - Condition: Current User is logged in - Permissions: check 'View all fields' This ensures that Bubble's Data API (which external callers can query) returns no CoStar data for unauthenticated requests. Without this rule, anyone who knows your Bubble Data API endpoint can fetch CoStar-populated records — violating your licensing agreement and exposing commercially sensitive property data. If your Bubble app has role-based access (e.g., only licensed broker users should see CoStar data, not all registered users), refine the privacy rule condition: - Condition: Current User is logged in AND Current User's role = 'Broker' (or however you define the licensed-user role) After adding privacy rules, test them: log out of your Bubble app, attempt to load a page that shows CoStar property data, and confirm it shows no data (or a login prompt). Log back in and confirm the data appears. Both states should behave as expected. For data types that store submarket analytics (which may be shared across multiple users), consider a separate rule: any logged-in user can view SubmarketStat records (since the stat is not property-specific PII), but Property and Comparable records require the licensed-user role.

1// Bubble Privacy Rules for CoStar data types
2// Configure in Data tab → [DataType] → Privacy
3
4// Rule 1 (for Property, Comparable data types):
5// Condition: Current User is logged in
6//            AND Current User's role = "Licensed User"
7// Permissions: View all fields = checked
8
9// Rule 2 (for SubmarketStat data type - aggregated, less sensitive):
10// Condition: Current User is logged in
11// Permissions: View all fields = checked
12
13// NO rule = public access = CoStar license violation

With credentials configured and privacy rules in place, build the core search and analytics workflows that your users will interact with daily. For property search: add a form to your Bubble page with inputs for Submarket (dropdown populated from a Bubble option set of submarkets), Property Type (dropdown: Office, Retail, Industrial, Multifamily), Minimum Building Size (number input), Maximum Building Size (number input), and Availability Status (dropdown). Add a 'Search' button. In the button's workflow: 1. Call the CoStar property search API Connector call with the form values as dynamic parameters. 2. For each property in the response, use 'Create a new thing' in the Property data type (or 'Make changes to' if a record with the same CoStar property ID already exists). Set cache_expires_at to Current date/time + 1 hour. 3. Navigate to (or show) the results Repeating Group. For the results Repeating Group: set data source to 'Search for Property where result_source = CoStar AND cache_expires_at > Current date/time'. This shows only fresh cached results. Add columns for property name, address, building SF, property type, and availability. For the comparables panel: add a workflow triggered by clicking a property row. Call the CoStar comparables endpoint with the selected property's CoStar property ID. Store results in the Comparable data type. Display in a secondary Repeating Group inside a popup, sorted by transaction_date descending. For the market analytics view: create a separate page or tab with SubmarketStat display. A Backend Workflow scheduled to run nightly fetches CoStar market analytics and populates the SubmarketStat data type. Users see the cached analytics, not live API calls — CoStar's market analytics data updates at most daily, so live calls would return the same data at extra WU cost. RapidDev's team has built CRE data platforms on Bubble integrating CoStar and ATTOM — if you want a free review of your data architecture before going live, book a scoping call at rapidevelopers.com/contact.

CoStar API calls consume both Bubble Workload Units and CoStar API call quota (which is contract-defined). Caching is therefore both a performance optimization and a cost management requirement. Every API call to CoStar should follow this pattern in your Bubble workflows: 1. Search Bubble DB for existing records matching the query criteria with cache_expires_at > Current date/time. 2. If fresh cached records exist: skip the API call, use cached data. 3. If no fresh records: call CoStar API, store results with cache_expires_at = Current date/time + appropriate TTL (1 hour for property details, 24 hours for market analytics). For market analytics (vacancy rates, asking rents): these update at most daily in CoStar's systems. A nightly Backend Workflow that refreshes SubmarketStat records is the right pattern — not on-demand API calls per page load. The Backend Workflow fetches all submarkets in your contracted scope and upserts the data. This requires a paid Bubble plan. For API call monitoring: go to Bubble Logs tab → API Logs. This shows every CoStar API call with timestamp, status code, and response size. Review this log weekly during the first month to identify any unexpected call patterns (e.g., a workflow firing more times than expected due to a triggering condition error). For license compliance monitoring: track your CoStar API call count in Bubble by incrementing a counter in a CoStarApiUsage data type on each call. Compare this against your contracted monthly quota and alert your admin team when usage approaches 80% of the limit via a Backend Workflow email action. Note: if a CoStar API call returns 403 (not 401), the issue is contract scope — not authentication. 401 means credentials are wrong. 403 means credentials are valid but the endpoint is outside your licensed scope. Contact your CoStar account manager for 403 errors, not your technical onboarding team.

1// Cache check conditional in Bubble workflow
2// Step 1: Do a search for Property
3//   - CoStar_property_id = [current search criteria]
4//   - cache_expires_at > Current date/time
5//   - :count > 0
6// If yes: use cached data (no API call)
7// If no: proceed to CoStar API call
8
9// Cache TTL recommendations
10// Property details: 1 hour (cache_expires_at = Current date/time + 1 hour)
11// Comparables: 6 hours (transaction history changes slowly)
12// Market analytics (vacancy, rent): 24 hours (daily refresh via Backend Workflow)