Skip to main content

​
Base URL

​
Authentication

Send your API key as a Bearer token on every call.
The hosted pages (/start, /manage) are not API endpoints: they are opened by users with links you sign. See Authentication. POST /api/connect-native is the exception: the mobile SDKs call it from the user’s device, authenticated by the signed link rather than by your API key. See Mobile apps.

​
Endpoints

Two deprecated forms keep working for integrations built before September 2026: GET /api/conversations?userRef= returns the same object as GET /api/connections, and the app secret is accepted as a Bearer token. New integrations must use the current forms.

​
Conventions

  • Requests and responses are JSON. Write endpoints return ok: true.
  • Errors are { "error": "<message>" } with a meaningful status code. Messages are stable strings; see Error handling.
  • Timestamps are ISO 8601 in UTC.
  • The GET endpoints are rate limited per app (600 requests per minute by default, raised on request) and return RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset; a 429 adds Retry-After.

​
Status codes