Skip to main content
Version: 1.0.0

Uysot Open API

Public contract for the Uysot Open API. Every endpoint lives under the /v1/open-api/* path and is authenticated with the X-Open-Api-Token header.

This specification is the source of truth for integrators: it lists every Open API endpoint, the authority each one requires, the request/response payloads and all enums you may receive.

Endpoints that are not under /v1/open-api/* (internal read endpoints, the admin/CRM UI APIs, etc.) are intentionally out of scope and not documented here.

Authentication & rate limiting​

Every /v1/open-api/** endpoint is authenticated with the X-Open-Api-Token request header. The raw token is SHA-256 hashed and matched against a stored token; an invalid, revoked or expired token returns 401 Unauthorized. Tokens are rate limited to 60 requests per minute — exceeding the limit returns 429 Too Many Requests.

Authorization (permissions & scopes)​

Authorization is expressed as grants — a pair of (permission, scope). A request is authorized when the token holds the specific permission:scope required by the endpoint. A request that lacks the required grant returns 403 Forbidden.

Permissions (resource domains):

  • PERMISSION_OPEN_API_LEAD — leads (also gates pipe & CRM-field reads)
  • PERMISSION_OPEN_API_LEAD_NOTE — lead notes
  • PERMISSION_OPEN_API_LEAD_TASK — lead tasks
  • PERMISSION_OPEN_API_CONTRACT — contracts (also gates contract-field reads)
  • PERMISSION_OPEN_API_CONTRACT_PAYMENT — contract payments
  • PERMISSION_OPEN_API_CALL_HISTORY — call history records

Scopes (actions): READ, SAVE, DELETE.

Response envelope​

Every successful response is wrapped in a ResponseData object. Paginated list endpoints return a PageableData object as data.

Asynchronous writes (requestId)​

Lead / lead-note / lead-task write endpoints (create, update, close, delete) are processed asynchronously. The endpoint validates the request, enqueues it, and immediately responds 200 with a requestId — the data is not persisted yet at that point. Poll GET /v1/open-api/request/{requestId} until the status is SUCCESS or FAILED.

Authentication​

Your raw Open API token. Required on every endpoint.

Security Scheme Type:

apiKey

Header parameter name:

X-Open-Api-Token