Authentication and headers

Two headers cover every request in this reference:

x-api-key: YOUR_API_KEY
Content-Type: application/json

x-api-key

Required on every request. The key identifies your organization, so you never pass an organization id.

Content-Type

Required on every request that sends JSON, so on every POST and PATCH. Without it the API ignores the body and reports a required field as missing. GET and DELETE requests ignore it, and the examples send it everywhere so they all look the same.

Keep the key secret. Anyone with it can read and change your contacts. Use it only from a server or an automation tool, never from a website or app that runs in the browser.

A missing or wrong key returns 401 unauthorized. If API access is turned off for your organization, every request returns 403 api_access_disabled.