We use essential cookies to make the site work. With your consent, we also use analytics + marketing cookies.
The REST API is versioned, JSON in/out, and follows a resource-oriented convention. Everything you can do in the dashboard is available programmatically.
curl https://api.cpaas.io/v1/messages \
-H "Authorization: Bearer sk_live_..." \
-H "Idempotency-Key: 4a2f-c81d-9e33" \
-H "Content-Type: application/json" \
-d '{
"channel": "whatsapp",
"to": "+919876543210",
"template":"welcome_v1",
"params": { "name": "Jane" }
}'Pick the surface that fits your tools — the API contract underneath is the same.
Every capability you can hit from the dashboard is here — REST, JSON in / JSON out, consistent naming, cursor-based pagination.
| Group | Description | Base path |
|---|---|---|
| Auth | Login, register, session, MFA enrollment, password reset. | /v1/auth |
| Messages | Send outbound, list, retrieve, cancel scheduled sends. | /v1/messages |
| Contacts | CRUD contacts + tags, custom fields, bulk import, GDPR erasure. | /v1/contacts |
| Campaigns | Create, schedule, launch, pause, stats per channel. | /v1/campaigns |
| Templates | Submit, approve, version, and reference message templates. | /v1/templates |
| Webhooks | Endpoints, secrets, deliveries, replay, dead-letter queue. | /v1/webhooks |
| Numbers | Search, provision, port, release, verify sender IDs. | /v1/numbers |
| Providers | Register per-org channel provider credentials, test connectivity. | /v1/providers |
| Routing | Rules, priorities, failover ladders across providers. | /v1/routing |
| Members | Invite, deactivate, roles, SCIM sync, session control. | /v1/members |
| Billing | Invoices, usage, plan, payment methods, Stripe checkout. | /v1/billing |
| Analytics | Delivery, engagement, cost, funnel metrics with rollups. | /v1/analytics |
Every request must include a bearer token in the Authorization header. Keys are scoped to a workspace and an environment.
sk_test_ prefix hits the sandbox and never bills.Authorization: Bearer sk_live_a02f...Any mutating request may include an Idempotency-Key header (any UUID or ULID). Retries within 24 hours return the original result.
POST /v1/messages
Authorization: Bearer sk_live_...
Idempotency-Key: 4a2f-c81d-9e33
{ "channel": "sms", "to": "+15551234567", "text": "hi" }Default limit is 1,000 requests per minute per workspace. Message sends are metered separately by channel. Every response carries X-RateLimit-* headers.
A 429 response includes a Retry-After header. SDKs auto-retry with jittered exponential backoff.
HTTP/1.1 200 OK
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 987
X-RateLimit-Reset: 1735684800
X-Request-Id: req_01H8YZ...Never HTML 500 bodies. Every error carries a stable code, a human message, optional per-field details, and a request id you can quote to support.
{
"error": {
"code": "validation_error",
"message": "Field 'to' must be an E.164 phone number.",
"details": [{ "path": "to", "issue": "invalid_format" }],
"requestId": "req_01H8YZQZ0K..."
}
}अपना 15 दिन का मुफ्त ट्रायल शुरू करें। क्रेडिट कार्ड की ज़रूरत नहीं।