Information
- OpenAPI version:
3.1.0
Overview
Digize API 1
Section titled “Digize API 1”The workspace’s data and actions, the same ones the app and its agent use.
Authentication. Create a key in Settings › API keys and send it as x-api-key: <key> or Authorization: Bearer <key>. A key belongs to one workspace and carries module permissions, such as crm:read or commerce:write; each operation names the one it needs (x-permission), and a key without it gets 403. While a workspace is read-only for an unpaid bill, writes other than settings answer 403 with details.reason: "billing_read_only".
Requests. GET and DELETE take their input in the query string (repeat a parameter for a list: ?tag=a&tag=b); the others take a JSON object in the body, up to 1 MB. Money is in the currency’s minor unit (1900 is $19.00) and times are ISO 8601. Operations marked x-confirm can’t be undone.
Limits. Requests are limited per client IP (1,000 a minute) and per key (600 a minute). Over either, the API answers 429 with retry-after in seconds.
Errors. Anything that fails answers with its HTTP status and { "error": { "code", "message", "details" } }: invalid (400), unauthorized (401), forbidden (403), not_found (404), conflict (409), too_large (413), rate_limited (429), unavailable (503) or internal (500). details.fields names each field that wasn’t valid. The message is written for people and may change; branch on code.
Pagination. Most lists answer up to 1,000 rows with a total. The long ones (contacts, orders, sent emails, the audit log, email activity and card taps) come a page at a time: send limit, and for the next page the cursor the previous answer gave as nextCursor, until it’s null. Keep the other parameters the same between pages.
Retries. Every POST, PATCH, PUT and DELETE takes an Idempotency-Key header: up to 255 printable characters, such as a UUID you make for each change. For 24 hours, sending the same key with the same method, path and body again answers the first response, with Idempotent-Replayed: true, and doesn’t make the change twice, so a request that timed out can be sent again safely. The same key with a different request answers 422, and one sent while the first is still running answers 409. Keys are kept per API key. A request refused before it ran (a bad key, the rate limit, input that isn’t valid) or one that failed with a 5xx isn’t kept, so it can be sent again with the same key.
Webhooks. Endpoints added under /webhooks, and Zapier REST hooks under /hooks, get each event as a JSON POST of { id, type, created_at, workspace_id, data }. Every delivery carries Digize-Signature: t=<unix seconds>,v1=<hex>, where the hex is HMAC-SHA256 under the endpoint’s secret of <t>.<raw body>: check it, and drop deliveries more than five minutes old. Answer with a 2xx within 5 seconds; anything else is retried with backoff, and 410 Gone removes the subscription.
Authentication
Section titled “Authentication”apiKey
Section titled “apiKey”Security scheme type: apiKey
Header parameter name: x-api-key
bearer
Section titled “bearer”Security scheme type: http