API Documentation — Overview

Status: structural documentation. Endpoint-level detail is maintained with each product build; confirm the live specification at [[API_DOCS_URL]] before integrating.

Access

APIs are available on Professional and Enterprise tiers. Request credentials through your Account Manager or the platform settings. Each integration gets its own credential set — credentials are never shared between integrations, and never sent over chat.

Authentication

Bearer token in the Authorization header. Tokens are scoped to a tenant or workspace and to a permission set. Rotate tokens at least every [[TOKEN_ROTATION_DAYS]] days and immediately if exposure is suspected.

Authorization: Bearer <token>
Content-Type: application/json

Conventions

• REST over HTTPS. HTTP is refused.
• JSON request and response bodies.
• ISO 8601 timestamps in UTC.
• Cursor-based pagination: ?limit=50&cursor=<token>.
• Idempotency key header supported on write operations.
• All list endpoints are tenant-scoped; cross-tenant access is not possible by design.

Standard response envelope

{
  "data": { },
  "meta": { "request_id": "...", "next_cursor": null }
}

Errors

Always log request_id — it is what support needs to trace an issue.

Rate limits

Default [[RATE_LIMIT]] requests per minute per token, with burst allowance. Higher limits available on Enterprise. Exceeding the limit returns 429 with Retry-After.

Typical resource families

Webhooks

Subscribe to events (interaction completed, ticket updated, SLA breached, invoice issued). Deliveries are signed; verify the signature before trusting the payload. Failed deliveries retry with exponential backoff for [[WEBHOOK_RETRY_WINDOW]].

Sandbox

A sandbox environment is available for integration testing with synthetic data. Never test against production with real customer records.

Support

Integration questions go through a ticket with the request_id and a sample payload attached. See 17_Support/02_Ticket_Workflow.md.