In short
- Agents, chats and contacts.Create, read, update and delete agents, and read conversations, messages and contacts.
- Keys with only what they need.Secret keys for your servers, restricted keys limited to the permissions you tick.
- OpenAPI 3.1 included.A machine-readable description is served live, generated from the same rules the API checks.
- Safe to retry.Send an Idempotency-Key and a retried write returns the first result instead of running twice.
An API lets your own software talk to OneType directly. Agencies set up agents for clients from a script, product teams pull conversations into their own reports, and ops teams keep agent settings in code. The REST API gives you the same data and rules as the dashboard, over plain HTTPS.
What you can do
- Agents: list, create, read, update and delete, including instructions, model, allowed domains and suggested questions.
- Conversations: list them by agent, status or start date, read one, and read its messages.
- Contacts: list and read the people your agent has met.
- Chat: open a conversation and get the agent's reply, as JSON or streamed.
- Download the OpenAPI 3.1 description at /v1/openapi.json.
Every message says whether it was written by AI or by your team. Lists use cursors, from 1 to 100 items a page, and stay stable while new items arrive. An update can carry the revision you read, so a change someone made in between is refused instead of overwritten.
API keys with scopes
Owners and admins create keys in Developer, API keys. A secret key can do what a workspace admin can do, except managing keys and owner-only actions. A restricted key holds only the permissions you tick, never more than your own. Use one restricted key per integration or script, so each can do only its job.
A key is shown once and stored hashed. The list shows the last characters of each key and when it was last used. Revoke a key and the very next request with it fails. Keys belong to one workspace and can never read another workspace's data.
Built for real integrations
Every error has the same shape, with a stable code, a message, field details where they apply and a request id. Send Idempotency-Key on a write and the first result is kept for 24 hours, so a retry after a timeout never creates a second agent or a second answer.
Each key can make 100 requests and up to 20 chat messages every 10 seconds. RateLimit headers show how much is left, and a 429 says how long to wait. The limits are the same on every paid plan. Requests with a wrong key are limited per network address.
What the API does not cover yet
Knowledge sources, usage, webhooks and integrations are managed in the dashboard, not through the API. Contacts are read-only. Keys are for servers only: there is no browser key yet. There is no published SDK on npm today, so use plain HTTPS or generate a client from the OpenAPI file.
The OpenAPI file is generated from the same schemas the API uses to check requests, so it never drifts from what the server accepts. The API only changes by adding things: new fields, new endpoints and new event types, so code that ignores unknown fields keeps working.