Omnichannel CRM platform REST API. Centralizes WhatsApp, Instagram DM, and Email into a unified inbox with real-time messaging, agent management, analytics, and contact tracking.
Authentication
Semua endpoint memerlukan autentikasi menggunakan API Key melalui header X-API-Key.
Code
Buat API key melalui menu Developer > API Keys di aplikasi, atau via endpoint
POST /api/api-keys (memerlukan login sebagai supervisor/admin). Key lama dengan
format omni_... tetap diterima dan diarahkan ke tenant default.
Catatan: key berformat
os_00000000_...yang dibuat oleh tenant non-default sebelum perbaikan multi-tenant tidak pernah valid dan tetap tidak valid setelah perbaikan — buat ulang key dari menu Developer > API Keys.
RBAC dan Izin
Platform menggunakan RBAC berbasis izin. Tiga role sistem bawaan tersedia (admin,
supervisor, agent) dengan hak akses tetap. Admin dapat membuat role kustom dengan
kombinasi izin yang fleksibel. Izin diperiksa per-endpoint menggunakan kode seperti
agents.manage, campaigns.manage, dan developer.access.
Error Responses
All errors return a consistent JSON format:
Code
timestamp plus the relevant id under data, e.g. data.message.id / data.conversation_id) together with the X-Omnistream-Event header, and verify the X-Omnistream-Signature HMAC. Do not assume exactly-once. Deliveries that exhaust all retry attempts (default 8, capped exponential backoff) move to a dead-letter queue (status = dead_letter) and can be replayed. During a secret-rotation overlap window each delivery carries two signatures — X-Omnistream-Signature (new secret) and X-Omnistream-Signature-Previous (old secret); accept the delivery if EITHER header matches the secret you have stored. Full runbook: docs/webhook-reliability.md.