OmniStream Docs
Chatqus CRM API

Chatqus CRM API

Omnichannel CRM platform REST API. Centralizes WhatsApp, Instagram DM, and Email into a unified inbox with real-time messaging, agent management, analytics, and contact tracking.

Authentication

Semua endpoint memerlukan autentikasi menggunakan API Key melalui header X-API-Key.

Code
X-API-Key: os_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Buat API key melalui menu Developer > API Keys di aplikasi, atau via endpoint POST /api/api-keys (memerlukan login sebagai supervisor/admin). Key lama dengan format omni_... tetap diterima dan diarahkan ke tenant default.

Catatan: key berformat os_00000000_... yang dibuat oleh tenant non-default sebelum perbaikan multi-tenant tidak pernah valid dan tetap tidak valid setelah perbaikan — buat ulang key dari menu Developer > API Keys.

RBAC dan Izin

Platform menggunakan RBAC berbasis izin. Tiga role sistem bawaan tersedia (admin, supervisor, agent) dengan hak akses tetap. Admin dapat membuat role kustom dengan kombinasi izin yang fleksibel. Izin diperiksa per-endpoint menggunakan kode seperti agents.manage, campaigns.manage, dan developer.access.

Error Responses

All errors return a consistent JSON format:

JSONCode
{ "error": { "message": "description", "code": 401 } }
Tags
Auth
Authentication (login, logout, session)
Conversations
Conversation management
Messages
Message retrieval and sending
Contacts
Contact management
Outgoing Webhooks
Outgoing webhook management (supervisor/admin only). Delivery is at-least-once: events are captured durably (Redis stream) and retried with exponential backoff, so the same event may be POSTed more than once (e.g. after a transient receiver/network failure or a dispatcher restart). Receivers must be idempotent — deduplicate on the event's natural identifiers in the JSON body (timestamp plus the relevant id under data, e.g. data.message.id / data.conversation_id) together with the X-Omnistream-Event header, and verify the X-Omnistream-Signature HMAC. Do not assume exactly-once. Deliveries that exhaust all retry attempts (default 8, capped exponential backoff) move to a dead-letter queue (status = dead_letter) and can be replayed. During a secret-rotation overlap window each delivery carries two signatures — X-Omnistream-Signature (new secret) and X-Omnistream-Signature-Previous (old secret); accept the delivery if EITHER header matches the secret you have stored. Full runbook: docs/webhook-reliability.md.
WA Templates
WhatsApp message template management