The public API

The public API is the workspace’s data and actions over HTTPS, the same ones the app and its agent use: contacts and opportunities, products and orders, invoices and payments, sites and deployments, campaigns, reviews and the rest. Every request is made with a workspace API key and is checked against the same permission a member’s click would be.

https://digize.com/api/v1

A first request

With a key that can read the CRM:

curl "https://digize.com/api/v1/contacts?search=maya" \
  -H "x-api-key: $DIGIZE_API_KEY"

And one that writes, with an Idempotency-Key so it can be sent again safely:

const response = await fetch("https://digize.com/api/v1/contacts", {
  method: "POST",
  headers: {
    authorization: `Bearer ${process.env.DIGIZE_API_KEY}`,
    "content-type": "application/json",
    "idempotency-key": crypto.randomUUID(),
  },
  body: JSON.stringify({
    firstName: "Maya",
    lastName: "Chen",
    email: "maya@northloop.example",
    tags: ["wholesale"],
  }),
});
if (!response.ok) {
  const { error } = await response.json();
  throw new Error(`${error.code}: ${error.message}`);
}
const contact = await response.json();

How it’s described

Every operation in the app that has a public route is in the API, and the API is described by one OpenAPI 3.1 document, made from the same operation registry the app runs on:

• https://digize.com/api/v1/openapi.json is the document itself, public and cached for five minutes. Generate a client from it, or import it into a tool like Postman.
• The reference on this site is rendered from that document when the docs are built, with each operation’s parameters, body, answers and examples.
• https://digize.com/api/v1/docs is an interactive reference of the same document, served by the app.

Two extensions say what the document’s standard fields don’t: x-permission is the permission an operation needs, such as crm:write, and x-confirm: true marks the operations that can’t be undone, such as DELETE /api/v1/sites/{site}.

What every request has in common

AuthenticationAPI keys, the permissions they carry, and what a key can't do.

Requests and errorsWhere input goes, what comes back, and every error code.

Idempotency-KeyRetrying a write without making the change twice.

PaginationLists with a total, and the long ones that page with a cursor.

Rate limitsPer address and per key, and what a 429 looks like.

WebhooksInstead of polling: the workspace's events, posted to you.