API & integrations

Owners and admins connect intSignal Connect to other systems in Admin → Integrations, titled API & Integrations. Anyone else who opens it sees "You need to be an owner or admin to manage integrations."

Turn on the API

The Public API switch is off until you turn it on: "When on, valid API keys can call /api/v1/*. Turning it off instantly rejects every key." The rest of the page appears once it's on.

Turning the switch off is the quickest way to stop every integration at once, for example if you suspect a key has leaked.

API keys

Create a key

Manage keys

The keys table shows each key's Name, the start of the Key, its Scopes and when it was Last used. Select Revoke to disable a key: "Revoke this key? Any integration using it stops working immediately."

Keys don't expire. To replace a key, create a new one, update your system, then revoke the old one. Review Last used regularly, and revoke keys nothing uses.

Using the API

• Base URL: https://connect.intsignal.com/api/v1
• Authentication: send your key in the Authorization header: Authorization: Bearer <your key>
• Format: JSON requests and responses
• Rate limit: 120 requests a minute per key
• Specification: select OpenAPI spec ↗ on the Integrations page for the machine-readable definition, at https://connect.intsignal.com/api/v1/openapi.json

Endpoints

Rules the API follows

• Placing calls: the extension must exist and have a phone, and its emergency address must be confirmed. Otherwise you'll get "Extension … must confirm its 911 address before placing calls."
• Sending texts: from must be one of your numbers with texting on, body can be up to 1,600 characters, and your workspace's texting limits apply.
• Meetings: a join link lasts expiresInHours, from 1 to 720, 24 by default. It allows guests.

Example: send a text

curl -X POST https://connect.intsignal.com/api/v1/messages \
  -H "Authorization: Bearer $INTSIGNAL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"from":"+19495550100","to":"+19495550123","body":"Your technician is on the way."}'

Webhooks

Webhooks send an HTTP POST to your system when something happens.

Add a webhook

1. Enter your endpoint's URL.
2. Tick the events to receive. Leave them all unticked to receive every event.
3. Select Add webhook. "Copy your signing secret now — it won't be shown again."

Webhooks can't be edited. To change one, add a new webhook and delete the old one.

Receiving webhooks

Each request has a JSON body { "event", "tenantId", "data" } and these headers:

• X-UCaaS-Event: the event name.
• X-UCaaS-Signature: sha256= followed by the hex HMAC-SHA256 of the raw request body, using your signing secret.

Your endpoint should:

1. Verify the signature with your signing secret before trusting the request.
2. Respond within 5 seconds, with any 2xx status. Do slow work afterwards.
3. Not rely on retries. Each event is sent once. For a complete record, read the matching data from the API, such as GET /calls, on a schedule.

CRM screen-pop

Open a customer's record in your CRM, or any web page, as soon as their call rings in a browser phone.

1. The CRM screen-pop section is on the Integrations page once the API is on.
2. Enter a URL starting with https:// or http://, using {number} for the caller's number and {name} for their caller ID name. For example: https://crm.example.com/search?phone={number}.
3. Save it, and ask your team to reload intSignal Connect.

When a call rings a browser phone, the page opens in a separate browser tab, which is reused for each call. Each person may need to allow pop-ups for connect.intsignal.com the first time.

{name} is the name sent with the incoming call, which may be empty. For reliable matching, look customers up by {number}.