Workspace API

Overview

Base URL: https://app.dialprong.com/api/v1

Authenticate with a workspace API key (dp_live_…). Create keys in the app under Settings → Integrations → API Keys. Agency operators select the client floor first; keys never span multiple subaccounts.

Quickstart

1. 1

   Create an API key

   In DialProng, open Settings → Integrations → API Keys. Keys look like dp_live_… and are scoped to one workspace.

   Open Integrations →
2. 2

   Send or receive events

   POST contact events to /api/v1/events with your key. Register a webhook URL to receive outbound events (including disposition.saved) from DialProng.

3. 3

   Verify webhook signatures

   Every outbound POST includes X-DialProng-Signature — an HMAC-SHA256 of the raw JSON body using your webhook secret.

Authentication

Pass the key on every request using either header:

Authorization: Bearer dp_live_…
# or
X-API-Key: dp_live_…

Requests are verified against a hash of the key. Workspace admins can view the full key again anytime from Integrations. Revoke compromised keys immediately from Integrations.

Tenancy & scoping

• Every API key belongs to exactly one business subaccount (client floor or standalone workspace).
• Agency desks do not hold Workspace API keys — agencies mint keys for a chosen client floor.
• Inbound writes stamp contacts with the key's subaccountId; you cannot set tenant fields in the payload.
• Updating a contact id from another workspace returns 404, not a cross-tenant leak.
• Outbound webhooks only fire for events that occur inside the same workspace that registered the endpoint.
• disposition.saved is outbound-only — subscribe under Webhooks; it cannot be POSTed to /api/v1/events.

Endpoints

curl 'https://app.dialprong.com/api/v1/events' \
  -H 'Authorization: Bearer dp_live_YOUR_KEY'

Inbound events

POST https://app.dialprong.com/api/v1/events

Accepted inbound events: contact.createdcontact.updated. All other catalog events are outbound-only.

curl -X POST 'https://app.dialprong.com/api/v1/events' \
  -H 'Authorization: Bearer dp_live_YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "event": "contact.created",
  "data": {
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "+14155552671",
    "email": "jane@example.com",
    "company": "Acme Co",
    "title": "VP Sales",
    "timezone": "America/New_York"
  }
}'

{
  "ok": true,
  "id": 12345,
  "event": "contact.created"
}

Webhooks

Register an HTTPS endpoint in Settings → Integrations → Webhooks. DialProng POSTs when subscribed events occur in that workspace. Outbound-only events: contact.createdcontact.updatedtask.createdtask.updatedbooking.confirmedbooking.cancelleddisposition.saved.

const crypto = require("crypto");
const expected = crypto
  .createHmac("sha256", WEBHOOK_SECRET)
  .update(rawBody)
  .digest("hex");
const valid = crypto.timingSafeEqual(
  Buffer.from(String(req.headers["x-dialprong-signature"] || "")),
  Buffer.from(expected)
);

Event reference

{
  "event": "contact.created",
  "data": {
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "+14155552671",
    "email": "jane@example.com",
    "company": "Acme Co",
    "title": "VP Sales",
    "timezone": "America/New_York"
  }
}

curl -X POST 'https://app.dialprong.com/api/v1/events' \
  -H 'Authorization: Bearer dp_live_YOUR_KEY' \
  -H 'Content-Type: application/json' \
  -d '{
  "event": "contact.created",
  "data": {
    "firstName": "Jane",
    "lastName": "Doe",
    "phone": "+14155552671",
    "email": "jane@example.com",
    "company": "Acme Co",
    "title": "VP Sales",
    "timezone": "America/New_York"
  }
}'

Errors

Error bodies are JSON: { "error": "…" }.

Security

• Store API keys and webhook secrets in a secrets manager — never in client-side code.
• Rotate keys by creating a replacement, switching consumers, then revoking the old key.
• Verify webhook signatures with a constant-time compare before trusting the payload.
• Do not send tenant override fields in inbound data; they are stripped or rejected.