Skip to main content
The Xobito API is a JSON-over-HTTPS REST API. It mirrors what the dashboard does — create contacts, send text/template/media messages, inspect delivery status, validate phone numbers, and receive outbound webhook events for contact, status, and source changes. This page is your starting point. If you already know the shape of REST APIs, skim the section below and jump to Authentication.

​
Base URL

The API is hosted on the main Xobito host. Your workspace subdomain is a path parameter — it is not a host-level subdomain. 
https://dash.xobito.com/api/v1/{subdomain}/...
SegmentExampleNotes
Hostdash.xobito.comThe single API host for all workspaces.
/api/v1/—Current API version.
{subdomain}acmeYour workspace subdomain, as a path parameter.

​
Example

If your workspace subdomain is acme, a list-contacts call looks like: 
GET https://dash.xobito.com/api/v1/acme/contacts
The subdomain is part of the path, not the host. Do not call acme.xobito.com — that is the dashboard host, not the API.

​
Content type

All requests and responses use JSON.
HeaderValue
Acceptapplication/json
Content-Typeapplication/json (on POST, PUT, PATCH)

​
Authentication at a glance

Xobito uses bearer tokens. Generate a token in the dashboard under Settings → API Management, then send it on every request: 
Authorization: Bearer apitk_<64-character-token>
Tokens carry scoped abilities — a token limited to contacts.read cannot send messages. Full details in Authentication.

​
Rate limits at a glance

The default rate limit is 60 requests per minute, per token. When you exceed the limit you receive 429 Too Many Requests with a retry_after field in the JSON body. Full details in Rate Limits.

​
Response envelope

All successful responses use a consistent envelope: 
{
  "status": "success",
  "data": { ... },
  "message": "..."
}
All errors use: 
{
  "status": "error",
  "message": "...",
  "errors": { ... }
}
See Errors for every error shape this API can return.

​
Webhooks

Xobito can push events to your server when contacts, statuses, or sources are created, updated, or deleted. Message delivery events, campaign events, and template events do not fire outbound webhooks — for message delivery, poll the Get message status endpoint. Start with Webhooks Overview.

​
SDKs

There are no official Xobito SDKs. The API is small and every endpoint in this reference ships with ready-to-copy examples in cURL, JavaScript, Python, and PHP.

​
Quick tour

Authentication

Generate and use API tokens.

Rate Limits

How throttling works and how to back off.

Errors

Every error shape and what it means.

Webhooks

Receive contact, status, and source events.

Data Types

Canonical schema for every object.

API Reference

Endpoint-by-endpoint reference.

​
Versioning

  • The current API version is v1.
  • Additive changes (new fields, new endpoints) ship inside v1.
  • Breaking changes ship under a new version prefix.
  • Depend on JSON field names, not ordering.