REST API and webhooks

Create support workflows through scoped, documented interfaces.

Create tickets, conversations and contacts, authorize external applications and receive signed events without bypassing workspace permissions.

View OpenAPI JSON Developer overview

AuthenticationAPI keys · OAuth 2.0

EventsHMAC-signed webhooks

ReliabilityIdempotency · retries

FormatJSON over HTTPS

GET/api/v1/tickets

List workspace-scoped support tickets.

POST/api/v1/tickets

Create a ticket with contact and site context.

POST/api/v1/conversations/{id}/messages

Add an approved agent or system message.

GET/api/v1/contacts/{id}

Read the customer record available to the scope.

POST/api/v1/webhooks

Subscribe an HTTPS endpoint to approved events.

POST/oauth/token

Exchange an authorization code using PKCE.

Webhook verification

Reject unsigned or replayed events.

Use the raw request body, timestamp and signing secret. Compare signatures in constant time and store provider event IDs for idempotency.

verify-webhook.php

$payload = file_get_contents('php://input');
$expected = hash_hmac('sha256', $payload, $secret);

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

// Queue the verified event and return quickly.

API checklist

Prepare a production integration.

Scoped API keys

OAuth authorization code with PKCE

OpenAPI specification

HMAC-signed webhooks

REST Hook subscriptions

Custom bidirectional channels

Cloud API production checklist

Protect customers when external systems fail.

Use scoped identities, short request timeouts, queues, idempotency, signature verification, bounded retries and visible delivery states.

Separate test and production credentials

Store secrets outside client code

Use idempotency keys for writes

Verify callback signatures and time

Handle rate limits and retry advice

Revoke credentials during incident tests