Skip to main content
This section lists every endpoint the Xobito REST API exposes. For conceptual background — base URL format, authentication, errors, rate limits, webhooks — start with the developer guide.

​
Base URL

All endpoints live under a single host, with your workspace subdomain as a path parameter: 
https://dash.xobito.com/api/v1/{subdomain}/
For a workspace subdomain of acme, a list-contacts call is: 
GET https://dash.xobito.com/api/v1/acme/contacts

​
Authentication

Every request requires a bearer token: 
Authorization: Bearer apitk_<your-64-char-token>
Accept: application/json
See Authentication for how to generate, scope, and revoke tokens.

​
Response shape

Successful responses use: 
{ "status": "success", "data": { ... }, "message": "..." }
Errors use: 
{ "status": "error", "message": "...", "errors": { ... } }
See Errors for every status code.

​
Versioning

The current version is v1. Additive changes ship inside v1. Breaking changes ship under a new version prefix.

​
Endpoints by resource

Contacts

Create, read, update, and delete contacts. List · Create · Update · Delete

Organize contacts

Taxonomy and grouping. Groups · Statuses · Sources

Templates

WhatsApp templates (read-only). List

Messaging

Send text, template, and media messages. Text · Template · Media

Message status

Poll a message’s delivery state. Get status

Phone validation

Validate the format of a phone number. Validate

​
Conventions

  • Content-Type — application/json on requests with a body.
  • Timestamps — ISO-8601 in UTC, microsecond precision.
  • Pagination — Laravel paginator format, nested under data. See Data Types.
  • Errors — consistent { status, message, errors } envelope. See Errors.

​
Need help?