Build on the Vaalo API

One REST API for leads, conversations, automations, payments, and the AI agents - versioned under /api/v1, authenticated with the same bearer tokens as the app. Your deployment's base URL is provided by your workspace owner; every path in the docs is relative to it.

"Copy for LLM" copies the complete API documentation as Markdown - paste it into any LLM and it can build against this API.

The auth model, in short

Bearer JWTs

One unified login

Every audience signs in at the same endpoint. The token states its kind - platform, tenant, or agency - and the server scopes every request to the token's own workspace. Tenant ids are never taken from the request.

Tenant API keys

For your website & forms

Keys look like vaalo_… and are shown in full exactly once; only their hash is stored. Revoking a key stops its ingest immediately.

Signed webhooks

Outbound, verifiable

Every delivery is HMAC-SHA256 signed over its raw body with your subscription secret, retried on a schedule, and can be redriven from the delivery log after a failure.

Platform operators can additionally issue service identities - revocable machine credentials for platform integrations, with every use written to the security log. Interactive OpenAPI documentation is served by the API host at /docs on the same base URL.

Quickstart

1. Create a workspace and sign in
Register a workspace, verify the admin email, then exchange the credentials for tokens at POST /api/v1/auth/login. Access tokens live 30 minutes; refresh tokens rotate and live 30 days.
2. Create your first lead
Send a lead with just a name and a phone number - the only two mandatory fields - and Vaalo dedupes it to a contact, assigns it, and starts the response-SLA clock.
3. Push leads from your own forms
Create a tenant API key and POST website enquiries straight into the ingest pipeline - the same raw-event-first path every connected source uses, so nothing is lost.
4. Subscribe to webhooks
Register your app's URL for events like lead.created and lead.converted, verify the HMAC signature, and keep your other systems in sync.