At a glance
Quickstart
Generate a key in the Salesfinity dashboard under Settings → Connections → API & Webhooks (Create New API Key), then confirm it works by reading the team it belongs to. Every key is scoped to exactly one team, and every response is filtered to that team.data, with each member’s user record, status and
license:
user._id values: writes that act as a person, such as creating a list, writing
a note, or any Sequencer write, take one as user_id. If the key is missing or wrong you get an
HTTP 403 with a JSON body rather than an HTML error page — see Errors.
Once the key works, the usual next step is to list the team’s contact lists and then read one:
Authentication
Every operation requires an API key in thex-api-key header. There is no OAuth flow and no
bearer token. Keys are long-lived until you revoke them in the dashboard.
A missing, malformed, revoked, or wrong-team key returns HTTP 403 Forbidden, not 401. That
is worth encoding in client code, because the conventional “retry auth on 401” branch will never
fire against this API.
message of the form Cannot GET /v1/..., with or without a key. A body that is not valid JSON
returns 400, and one over the size limit returns 413.
There is no separate sandbox host. See the developer portal for how
to test against live data safely.
Conventions
Pagination
List endpoints takepage (1-based) and limit as query parameters. Each operation’s limit
parameter states its default and maximum. Most v1 lists default to 10, the contacts inside a list
to 50, and CRM sequences to 100. A limit above the maximum is treated as the maximum: 100 on
every list, 200 for sending mailboxes and 25 for enrollment runs. Every page says the limit it
used, so compare it with what you asked for. A limit that is not a positive number, or a
/v2/sequencer page over 10,000, fails with 400.
The response envelope depends on the endpoint family:
A few short
/v2/sequencer lists are not paged and return a plain array: a sequence’s steps, the
team’s policies, a task’s events (the latest 200), and enrollment runs (the most recent, up to
limit, default 10, at most 25).
Errors
Every error response, on every endpoint and every status code, uses the same JSON envelope:
Two rarer statuses are covered on the Errors page: 405
from
/v2/sequencer during planned maintenance, and 503 when enabling a sequence briefly cannot
set up email sending. Retry both later.
Branch on error or statusCode rather than on message. Retry 429 and 5xx with
exponential backoff; 400, 402, 403, 404, 413 and 422 will not succeed on an
identical retry. Outside the Sequencer, POST endpoints are not idempotent, so confirm state with
a GET before retrying a create. Sequencer POSTs accept an Idempotency-Key header that makes
a retry safe. The full envelope, per-status examples, and recovery steps are on the
Errors page.
Rate limits
Limits are per team and per minute, and every API key on the team shares them. Every response to an authenticated request reports what is left inX-RateLimit-* headers, and a 429 says how long
to wait in Retry-After. Rate limits lists the limit for each group
of routes and shows how to pace a bulk job.
Webhooks
Webhook subscriptions are created and managed in the Salesfinity dashboard, not through this API: Settings → Connections → API & Webhooks, then Create new under Webhooks. A subscription has a name, one or more events, the call dispositions it applies to, and a publichttp or https URL; localhost and private, loopback or link-local addresses are refused.
Click a subscription in that list to see its delivery log.
Each delivery is a
POST with a JSON body of the form { "event": "...", "payload": { ... } }.
For CALL_LOGGED and CONTACT_SNOOZED, payload is the call log or the snoozed contact. For
the SEQUENCE_* events it has the same shape every time:
null, and occurred_at is an ISO 8601 time in UTC.
contact is a short identifier, not the full record: its company is the company’s ID, and a
field the contact does not have is left out. It is null when the event has no contact, and only
{ "id": ... } when the contact no longer exists. details carries event-specific data, such as a
reply’s category and confidence in the example, is null when there is none, and can gain keys
over time, so treat every key in it as optional. For a task event written by the cadence engine,
task_id is null and the task’s ID is in details.task; read both.
Delivery rules:
- Headers. Every delivery has
content-type: application/jsonand anx-salesfinity-event-idheader,evt_followed by 32 hexadecimal characters. - Retries. An attempt that times out, cannot connect, or gets a 429 or a 5xx is retried, up to 3 attempts in total: after about half a second, then after about one second, each plus up to half a second of jitter. Every attempt for one event finishes within about 30 seconds, so an endpoint that is down for longer misses it; reconcile through the API after an outage. Any other 4xx is not retried; the event is dropped and recorded in the delivery log.
- Duplicates. The event ID is the same on every attempt and on any redelivery of one event, so the same event can arrive more than once. Record the IDs you have processed and skip repeats.
- Timeouts. Each attempt waits at most 10 seconds for your response. Answer with a 2xx quickly and do the work afterwards.
- Ordering. Subscriptions are delivered independently and events are not ordered. Use
occurred_at, not arrival order. - Signatures. Subscriptions created since signing was introduced also send
x-salesfinity-signature:sha256=followed by the HMAC-SHA256 of the raw body. The dashboard does not show the signing secret, so the signature cannot be checked yet. Until it can, put a long random token in the subscription URL and reject requests that do not carry it.
callback_url
rather than a standing subscription, and those callbacks carry neither header above. See
Start an email enrichment and
Start a phone enrichment.
What you can do with the API
The REST API exposes 114 operations across 21 groups. Every operation has a uniqueoperationId, a
description, typed parameters, and a JSON response schema in the OpenAPI description.
Complete endpoint index
Every operation in the API, with its HTTP method, path, and reference page. This table is generated from the OpenAPI description, so it is always in sync with the spec.Contact Lists
Teams
Dispositions
Sequences
Call Logs
Analytics
Snoozed Contacts
Follow-up Tasks
Custom Fields
Scored Calls
Notes
Enrichment
Sequencer Sequences
Sequencer Steps
Sequencer Templates
Sequencer Enrollments
Sequencer Enrolment Runs
Sequencer Tasks
Sequencer Suppression
Sequencer Policies
Sequencer Settings
Resources for agents and crawlers
/llms.txt— a compact index of every page on this site./llms-full.txt— the full documentation as a single plain-text file./api-reference/openapi.json— the complete OpenAPI 3.0.1 description./sitemap.xml— every canonical URL./.well-known/agent-skills/index.json— an agent skill for working with Salesfinity through the API or the MCP server.- Any page also serves Markdown. Append
.mdto a page URL, or sendAccept: text/markdown, to get the source instead of the rendered page.
Getting help
Email [email protected] or browse the help center. When reporting an API problem, include therequest_id from the error body (or the X-Request-Id response header), the request path, the
timestamp, and the error and statusCode — the request ID lets Salesfinity find the exact
request in its logs.