API
Base URL
The API answers on the website's serving domain: the client's custom domain when one has been declared, the platform's domain otherwise. The exact address appears in the integration tag; do not hard-code it anywhere else.
All paths start with /api/.
Formats
| Topic | Convention |
|---|---|
| Request bodies | JSON, Content-Type: application/json |
| Response bodies | JSON, always |
| Dates | ISO 8601, in UTC — 2026-09-15T09:22:41+00:00 |
| Website identifiers | UUID |
| Form identifiers | the readable identifier chosen by the client — contact, quote |
| Amounts | never exposed by this API |
Collection responses are wrapped in data. Action responses are not: they carry their
fields directly (success, token, message).
Pagination
None: the exposed collections — an organization's websites — number in the tens. Should
that change, a pagination field would appear next to data, without altering the
existing shape.
Authentication
Three schemes, depending on the caller:
| Caller | Mechanism |
|---|---|
| Visitor's browser, public endpoints | Origin header, compared with the website's host |
| Visitor's browser, submission | in addition: short-lived signature and captcha |
| Client's server | Authorization: Bearer …, scoped to one organization |
CORS
Endpoints under /api/ accept cross-origin requests: a visitor's browser calls them from
the client website's domain.
| Topic | Value |
|---|---|
| Methods | GET, POST, OPTIONS |
| Allowed headers | Accept, Content-Type, X-Website-Signature, X-Website-Timestamp, X-Captcha-Provider, X-Captcha-Token |
| Credentials | no — no cookie, no session: do not send credentials: 'include' |
| Preflight | cached for 24 hours |
DELETE is not allowed cross-origin: the token revocation endpoints are called from a
server, never from a page.
The integration script, loaded through a <script src> tag, is not subject to CORS.
What the API does not expose
Neither received requests, nor statistics, nor a website's signing key. A token gives access to the website directory of its organization, and nothing else.