Connect Xat CRM to what you already use.
A REST API and outgoing webhooks to integrate your conversations, contacts and messages with your own systems.
- endpoints
- 29
- scopes
- 16
- events
- 9
How it works
The API lives on its own domain and authenticates with keys you create from your workspace. Each key carries only the scopes you grant it.
- Base URL
https://api.xatcrm.com/public/v1Every endpoint below hangs off this path.
Authentication
Every request carries an API key in the Authorization header. An alternate header is also accepted if your client cannot send Authorization.
Authorization: Bearer xat_live_…Keys are created from Settings → API keys in your workspace. The full key is shown once, at creation: after that only its fingerprint is stored, so we cannot recover it for you.
X-Xat-Api-Key
Scopes
Scopes are granted explicitly. A key can only call endpoints whose scope it holds, and granting write does not grant read.
| Resource | Available scopes |
|---|---|
| contacts | contacts:readcontacts:write |
| conversations | conversations:readconversations:write |
| messages | messages:readmessages:write |
| inboxes | inboxes:read |
| labels | labels:readlabels:write |
| assignments | assignments:readassignments:write |
| attachments | attachments:readattachments:write |
| notes | notes:readnotes:write |
| quickreplies | quickreplies:read |
Rate limits
Limits apply per key. Every response includes headers with your current usage, so you can slow down before you run out.
- General
600/min- Sending messages
60/min- Response headers
X-RateLimit-LimitX-RateLimit-RemainingX-RateLimit-Reset
Idempotency
Write operations accept an idempotency key. Repeat the same request with the same key — because the network dropped or your process retried — and you get the original result instead of a second write.
Pagination
Lists paginate by cursor. Each response tells you how to ask for the next page; there are no page numbers to shift when new data arrives.
Errors
Errors arrive with a stable code inside a uniform envelope. The code is the contract: the message may change, the code does not.
Ready to integrate?
Create your workspace and generate your first API key.