Build With Syndelo

Your First Request

1. Use a Growth or Scale workspace. Open Settings → API Access as a user with Settings permission.
2. Create a read-only key and copy it once. The screen provides your workspace UUID. Use your deployment’s origin as SYNDELO_ORIGIN (locally, http://127.0.0.1:5178).
3. Set SYNDELO_API_KEY and WORKSPACE_ID in your server environment, then request the contact list.

curl "$SYNDELO_ORIGIN/api/v1/organizations/$WORKSPACE_ID/contacts?per_page=25" \
  -H "Authorization: Bearer $SYNDELO_API_KEY" \
  -H "Accept: application/json"

Never send API secrets in a URL, embed them in frontend code, or commit them to source control. Use HTTPS in production. Server-to-server requests need the bearer header, not session cookies or CSRF tokens.

Access That Follows Your Workspace

Launch does not include public API access. Growth and Scale do. The parent subscription determines eligibility for its workspaces. Every request checks the current plan, workspace membership, user permissions, and key scope. Downgrades or revoked membership take effect on subsequent requests.

Each key belongs to one user and one workspace, expires in 1–90 days, and has read-only or read/write access. A write key does not override a Read Only role or grant missing permissions. Key creation requires settings.write; you can revoke your own keys even after a downgrade. Shared demo accounts cannot create or use API keys.

The reference below is the supported public surface. Browser authentication, billing, token management, investor-only flows, file uploads/downloads, and sandbox simulation endpoints are not exposed through these keys. MCP uses its own token and endpoint; the two key types are not interchangeable.

Request Conventions

• Base path: /api/v1/organizations/{organization}. IDs are workspace or record UUIDs unless a field says otherwise.
• Send Accept: application/json. For bodies, also send Content-Type: application/json.
• Amounts named amount, target, or minimum use USD decimal strings, such as "25000.00". Returned _cents fields are integer cents. Rate fields ending in _bps use basis points.
• Use the endpoint’s documented pagination parameters. Contact lists support page and per_page (1–100); not every collection is paginated. Paginated responses include data and Laravel pagination metadata. Other responses are endpoint-specific records or result objects.
• Versioned updates require the current version or revision. Read the record first. PATCH operations may still require complete fields as documented.
• Payment preparation and distribution creation use the Idempotency-Key header. Agreement preparation uses a body request_key. Reuse a key only for an identical retry; other writes do not offer a general idempotency guarantee.

Errors, Limits, And Retries

Responses use HTTP status codes and JSON error messages. Validation failures also include an errors object keyed by field.

401

Missing, invalid, expired, or revoked key.

403

Plan, workspace scope, role, or token access does not permit this action.

404

The record does not exist in this workspace.

409

A record changed or an operation conflicts. Fetch current state before retrying.

422

Invalid fields or exceeded plan capacity. Correct the request or upgrade.

429

Rate limited. Wait for the Retry-After header before retrying.

5xx

Server or provider failure. Inspect current state before repeating a write.

Limits: 120 requests per minute per key and 180 per minute per user across the authenticated REST API. Individual actions can have stricter limits. Use exponential backoff with jitter for safe reads and respect Retry-After. Do not blindly replay a write after a timeout.

Financial actions retain maker/approver and acknowledgment rules. Signing, verification, email, and AI operations depend on configured providers. A successful sandbox response is not a real-world payment or verification.

Endpoint Reference

Generated from the shared API/MCP operation catalog. The same catalog also limits which endpoints API keys can call.

Loading API Reference…