The Agency Pro public API gives your code the same reach as the dashboard — the CRM, every inbox, the calendar, quotes and invoices, phone and SMS, forms and tables, the chatbot queue, Agent Ivan, social posting, communities and client sub-account provisioning — plus signed webhooks the moment anything changes.
The platform, over REST
Bearer-key auth · JSON in, JSON out
120 requests/min per key · errors as { "error": { "code", "message" } }
16 resources
from contacts to sub-account provisioning
14 scopes
grant each key exactly what it needs
15 events
signed HMAC-SHA256, retried up to 8×
120 req/min
per key, with Retry-After on 429
Three things happen in order. You bring the HTTPS endpoint; the platform brings the events, the signatures and the retries.
In Sub-accounts → API & webhooks, name the key and tick exactly the scopes it needs — contacts, bookings, webhooks, whatever the integration calls for. The key (aiv_ + 40 hex characters) is shown exactly once; only its SHA-256 hash is stored.
Scoped, revocable, never stored in plaintext
New API key
Sub-accounts → API & webhooks
Missing a grant? The call returns 403 missing_scope
Send the key as a bearer token on every request. Calls default to your agency workspace; add the X-Tenant-Id header to act on any client sub-account. Lists paginate with limit/offset, errors come back as { error: { code, message } }, and each key gets 120 requests per minute.
120 req/min · Retry-After on 429
The platform, over REST
Bearer-key auth · JSON in, JSON out
120 requests/min per key · errors as { "error": { "code", "message" } }
Register an HTTPS endpoint — in the dashboard or via the API — and pick your events. Every delivery is a signed POST (X-Agency-Event plus an HMAC-SHA256 in X-Agency-Signature) retried with exponential backoff, up to 8 attempts, until you answer 200.
15 events · HMAC-SHA256 · 8 attempts
Webhook delivery
Signed POST · retried up to 8 times
Agent Ivan
Your endpoint
yourapp.dev/hooks/ivan
HTTPS only · up to 10 endpoints
X-Agency-Event:
X-Agency-Signature: sha256=9f2c4e…
· backoff 2^n min, cap 6h
HMAC-SHA256 over the raw body, keyed by your endpoint secret
Nine resource groups cover the platform end to end — for your agency workspace or any client sub-account, via the same key.
The whole lead database over REST: search by name, email or phone, filter by pipeline stage, and create, update or delete records — with limit/offset pagination on every list.
$ curl /api/v1/contacts?q=roofline&limit=50
Read SMS, social and email threads, pull a full transcript, reply on any of them, or start a brand-new text — SMS debits the phone usage wallet.
Read live slots, book against them (a taken slot returns 409, never a double-booking), then cancel or reschedule — calendar event and emails included.
Draft a quote from line items, email it, convert the approved one into an invoice, and send that too — numbering and totals handled for you.
$ curl /api/v1/invoices?status=paid
The workspace's provisioned numbers, and outbound texts that match (or create) the contact and land in the same thread the Unibox shows.
Read forms and their submissions, page or search table rows, and write rows back by column name — with a dedupe key so retries update instead of duplicating.
$ curl -X POST /api/v1/tables/:id/rows -d '{"fields":{"Email":"a@b.co"}}'
Widget chats with their full history, the escalation queue waiting on a human, and staff replies that take the conversation over from the bot.
Ivan's suggestion queue, highest confidence first — approve the internal ones from your own code, dismiss the rest and he learns from it.
Create a post once and it fans out to a variant per connected account. Schedule it, or publish immediately.
List communities with their channels, read message history, and post to a channel as the community owner.
Spin up client workspaces cloned from your templates, list and inspect them, and archive them when the engagement ends — quota-gated by your plan.
$ curl -X POST /api/v1/sub-accounts -d '{"name":"Acme Co"}'
Plan, subscription standing, lead-credit balance and phone usage for the agency or any sub-account you govern.
Register up to 10 HTTPS endpoints and subscribe each to all events or a subset. The signing secret is shown once.
Every event can leave the platform as a signed webhook, and every resource answers to a REST call. Three recipes your stack can run on day one.
Close a deal in your own stack and the client workspace builds itself: one POST clones your template account, the sub_account.created webhook confirms it, and every follow-up call just carries X-Tenant-Id.
New client signs with you
From your own onboarding or CRM
POST /api/v1/sub-accounts clones your template
Clone template workspace
sub_account.created fires
X-Tenant-Id targets it
Seed contacts via API
Client live in their own workspace
Data isolated; your key governs them all
The lead.created webhook hits your endpoint the moment a lead lands — from any source, in any sub-account. Score it your way, then call back in: send the first reply, book the slot, move the stage.
lead.created webhook arrives
Signed POST to your endpoint
Your stack scores it, then calls back in
POST conversations/reply
POST bookings
PATCH contact stage
message.inbound watch
Lead engaged in seconds
Every step logged in the CRM
When invoice.paid fires, pull the full invoice with line items, update the contact record, and send the thank-you — your accounting stays in lockstep without anyone exporting a CSV.
invoice.paid webhook arrives
Fires for any sub-account too
Your back office reconciles itself
GET invoices/:id lines
PATCH contact value
Email a thank-you
GET usage balances
Books balanced, client thanked
Zero swivel-chair ops
Every endpoint, query parameter and payload shape is documented in the live reference — including a copy-paste webhook signature verifier.
Your key governs the agency and every sub-account under it. Requests default to your own workspace; one header routes them to a client instead — and webhooks do the same in reverse, with the tenant id on every payload.
One key, every workspace
The same call, routed per client
Brightline Agency
Agency workspace
Radiance Aesthetics
Sub-account
Summit Realty Group
Sub-account
Brightline Solar
Sub-account
200 OK · tenant:
Start the trial, mint your first scoped key, and have a signed webhook landing in your endpoint before lunch.
The public API is included on the Agency Pro plan.
Every request sends your key as a bearer token — Authorization: Bearer aiv_…. Keys are created in Sub-accounts → API & webhooks, are scoped per resource, and can be revoked at any time. Only the SHA-256 hash is stored; the plaintext is shown exactly once at creation.
Still curious? The fastest answer is minting a key.
Start your free trial, upgrade to Agency Pro when you're ready, and let your code run the agency — keys, scopes, signatures and retries included.
7-day free trial · your own workspace free forever · cancel anytime during the trial.