Conduyt Sms Providers API

openapi: 3.2.0
info:
  title: Conduyt Sms Providers API
  version: 1.0.0
  description: 'The Conduyt CRM API provides programmatic access to your CRM data including

    contacts, companies, deals, pipelines, tasks, notes, automations, invoices,

    email sequences, and more.


    ## Authentication


    All authenticated endpoints require a Bearer token (API key) in the

    `Authorization` header:


    ```

    Authorization: Bearer cdy_

    ```


    API keys are generated in **Settings > API Keys** within the Conduyt

    dashboard. Keys use the `cdy_` prefix and are hashed with bcrypt on

    creation — the full key is shown exactly once at creation time.


    Session cookie authentication (`conduyt_session`) is also supported for

    browser-based clients but is not recommended for integrations.


    ## Rate Limiting


    API keys enforce a per-key rate limit. New keys default to 100 requests per

    minute and can be configured at creation time or with PATCH `/api-keys/{id}`.

    Some public and provider-facing endpoints also enforce stricter per-IP or

    per-account limits. When exceeded, the API returns `429 Too Many Requests`

    with a `Retry-After` header indicating seconds until the next allowed

    request.


    | Endpoint Group | Limit |

    |---------------------|---------------------|

    | API keys | Default 100 / min per key |

    | Login/reset | 5 / min per IP |

    | Registration | 3 / hour per IP |

    | Contact/Deal create | 30 / min per IP |

    | Inbound messages | 120 / min per account/IP |


    ## Pagination


    List endpoints support cursor-based pagination via query parameters:


    - `page` — Page number (default: 1)

    - `per_page` — Items per page (default: 50, max: 200)

    - `limit` — Accepted as an alias of `per_page` on `GET /contacts`; if both are

    sent they must carry the same value.


    A page size above the maximum, a non-integer, a value below 1, or a

    pagination key repeated with different values is rejected with `400`

    (the message names the parameter and the rule); nothing is silently

    clamped or ignored.


    Responses include a `meta` object: `{ page, per_page, total }`.


    An operation that documents its own pagination rules follows those instead.

    `GET /sms-providers/options` pages with an opaque `cursor` and a `limit`

    that is capped at 50 rather than rejected; its responses carry

    `meta: { nextCursor, truncated }`.


    ## Response Format


    All successful responses wrap data in a `data` envelope:

    ```json

    { "data": { ... } }

    ```


    Error responses use:

    ```json

    { "error": "Human-readable error message" }

    ```


    ## Multi-Tenancy


    Conduyt is multi-tenant. All data is scoped to the authenticated user''s

    current account. API keys are bound to a specific account at creation time.


    ## Webhook Events


    Outbound webhooks fire on events including:

    `contact.created`, `contact.updated`, `contact.deleted`,

    `deal.created`, `deal.updated`, `deal.won`, `deal.lost`,

    `task.created`, `task.completed`, `note.created`,

    `appointment.created`, `appointment.updated`,

    `form.submitted`, `invoice.paid`


    Payloads are signed with HMAC-SHA256 using the webhook''s secret. Retry

    schedule: 1m, 5m, 30m, 2h, 12h, 72h (7 total attempts including the initial delivery).'
  contact:
    name: Conduyt Support
    url: https://conduyt.app
    email: support@conduyt.app
  license:
    name: Proprietary
    url: https://conduyt.app/terms
servers:
- url: https://conduyt.app/api/v1
  description: Production
security:
- BearerAuth: []
tags:
- name: Sms Providers
paths:
  /sms-providers/{id}/test:
    post:
      x-generated: true
      operationId: postSmsProvidersIdTest
      summary: Create / invoke sms-providers id test
      tags:
      - Sms Providers
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: dry_run
        in: query
        required: false
        description: Validate the mutation without persisting changes.
        schema:
          type: boolean
      - name: sandbox
        in: query
        required: false
        description: Run the mutation in sandbox mode.
        schema:
          type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                oneOf:
                - type: object
                  properties:
                    data:
                      type: object
                      properties:
                        success: {}
                        statusCode: {}
                        responseTime: {}
                        correlation: {}
                        responseBody: {}
                        headers: {}
                      required:
                      - success
                      - statusCode
                      - responseTime
                      - correlation
                      - responseBody
                      - headers
                  required:
                  - data
                - type: object
                  properties:
                    data:
                      type: object
                      properties:
                        success:
                          type: boolean
                        error:
                          type: string
                      required:
                      - success
                      - error
                  required:
                  - data
  /sms-providers/{id}:
    delete:
      x-generated: true
      operationId: deleteSmsProvidersId
      summary: Delete sms-providers id
      tags:
      - Sms Providers
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      id: {}
                      deactivated:
                        type: boolean
                    required:
                    - id
                    - deactivated
                required:
                - data
    get:
      x-generated: true
      operationId: getSmsProvidersId
      summary: Get sms-providers id
      tags:
      - Sms Providers
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      campaignCount: {}
                      _count: {}
                    required:
                    - campaignCount
                required:
                - data
    patch:
      x-generated: true
      operationId: patchSmsProvidersId
      summary: Update sms-providers id
      tags:
      - Sms Providers
      parameters:
      - name: id
        in: path
        required: true
        schema:
          type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              additionalProperties: false
              properties:
                name:
                  type: string
                  minLength: 1
                  maxLength: 120
                  description: Leading and trailing whitespace is trimmed before the length check, so a blank value is refused.
                mode:
                  type: string
                  enum:
                  - webhook
                  - builtin
                webhookUrl:
                  anyOf:
                  - type: string
                    format: uri
                    description: 'The server parses the value with the WHATWG URL parser (Zod''s .url()), not RFC 3986: it accepts a space (percent-encoded), a non-ASCII host, a second ''#'', an invalid percent escape and a bare scheme such as `x:`, which a strict `format: uri` validator refuses, and it refuses an empty host such as `http://` and a port above 65535, which that validator accepts.'
                  - type: 'null'
                webhookHeaders:
                  anyOf:
                  - type: object
                    additionalProperties: {}
                  - type: 'null'
                fieldMapping:
                  anyOf:
                  - type: object
                    additionalProperties: {}
                  - type: 'null'
                responseConditions:
                  anyOf:
                  - {}
                  - type: 'null'
                color:
                  type: string
                  pattern: ^#[0-9a-fA-F]{6}$
                isActive:
                  type: boolean
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      campaignCount: {}
                      _count: {}
                    required:
                    - campaignCount
                required:
                - data
  /sms-providers/template-options:
    get:
      operationId: getSmsProvidersTemplateOptions
      summary: List the SMS providers a template can be bound to (redacted)
      description: 'The redacted provider list the SMS Templates page loads: each ACTIVE provider''s id, name and colour, ordered by name,

        for the caller''s own account. Nothing else is returned: no webhook URL or headers, field mapping, counts or

        credentials. The caller needs email_templates.view OR settings.view (the management route GET /sms-providers

        needs settings.view only). An API key reaches it with an `emails`, `sms`, `messages` or `settings` scope (the member behind the key still needs one of the two permissions). Unlike GET /sms-providers/options (the send

        picker: usable, URL-safe webhook providers) this lists every active provider, builtin included.'
      tags:
      - Sms Providers
      responses:
        '200':
          description: The active providers
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                - meta
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      required:
                      - id
                      - name
                      - color
                      properties:
                        id:
                          type: string
                          format: uuid
                        name:
                          type: string
                        color:
                          type: string
                  meta:
                    type: object
                    description: 'lineReady: whether a text could leave this account at all (a usable provider, the built-in Twilio line, Project Blue or FromK.ai), judged by the send path''s own check'
                    required:
                    - lineReady
                    properties:
                      lineReady:
                        type: boolean
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          description: Neither email_templates.view nor settings.view
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
      parameters: []
  /sms-providers/health:
    get:
      x-generated: true
      operationId: getSmsProvidersHealth
      summary: List sms-providers health
      tags:
      - Sms Providers
      parameters:
      - name: days
        in: query
        required: false
        description: Query parameter read by this route.
        schema:
          type: integer
          default: 30
          minimum: 1
          maximum: 365
        x-default-provenance: handler_literal
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    properties:
                      providers: {}
                      summary: {}
                    required:
                    - providers
                    - summary
                required:
                - data
  /sms-providers:
    get:
      x-generated: true
      operationId: getSmsProviders
      summary: List sms-providers
      tags:
      - Sms Providers
      responses:
        '200':
          description: Success
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
    post:
      x-generated: true
      operationId: postSmsProviders
      summary: Create / invoke sms-providers
      tags:
      - Sms Providers
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              properties:
                color:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                fieldMapping:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                mode:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                name:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                responseConditions:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                webhookHeaders:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
                webhookUrl:
                  description: Read by the handler from the JSON body (the route declares no schema for its type).
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/DataEnvelope'
  /sms-providers/options:
    get:
      operationId: getSmsProvidersOptions
      summary: List sms-providers options
      description: 'Provider picker for the SMS provider dropdown: the id and name of every provider the send service can

        actually use (active webhook providers whose webhook URL passes the outbound safety check), ordered by

        name. Reachable with a key scoped `sms` or `messages`; the caller needs communications.view or

        communications.create.


        Pagination on this operation is cursor-based and differs from the global `page` / `per_page` rules:

        - `limit` (1-50, default 50) is how many providers to return. A `limit` above 50 is capped to 50, not

        rejected; 0, a negative or non-integer value, or a repeated `limit` is a 400.

        - `cursor` resumes after the last row the previous page scanned. Pass `meta.nextCursor` back unchanged.

        An empty, malformed or repeated cursor is a 400.

        - One request checks at most 250 providers, so a page can hold fewer than `limit` items while more

        remain. Keep paging while `meta.nextCursor` is not null; `meta.truncated` is true exactly when it is set.


        A 503 with `Retry-After` means the webhook URLs could not be verified right now (a resolver outage);

        the response is never a partial list.'
      tags:
      - Sms Providers
      parameters:
      - name: cursor
        in: query
        required: false
        description: 'string — opaque continuation token: pass the previous page''s meta.nextCursor unchanged to resume after the last row it scanned. Omit for the first page; an empty, malformed or repeated cursor is a 400.'
        schema:
          type: string
      - name: limit
        in: query
        required: false
        description: integer 1-50 (default 50) — how many usable providers to return. A value above 50 is capped to 50 (not rejected); 0, a negative or non-integer value, or a repeated limit is a 400.
        schema:
          type: integer
          minimum: 1
          maximum: 50
          default: 50
        x-default-provenance: authored_operation
      responses:
        '200':
          description: One page of usable providers
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                - meta
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      required:
                      - id
                      - name
                      properties:
                        id:
                          type: string
                          format: uuid
                        name:
                          type: string
                  meta:
                    type: object
                    required:
                    - nextCursor
                    - truncated
                    properties:
                      nextCursor:
                        type:
                        - string
                        - 'null'
                        description: Opaque token for the next page (pass as `cursor`); null when every provider has been scanned
                      truncated:
                        type: boolean
                        description: True exactly when nextCursor is set, i.e. more providers remain to be scanned
        '400':
          description: Invalid cursor or limit (the error names which)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
        '503':
          description: Provider webhook URLs could not be verified right now; retry after the Retry-After seconds
          headers:
            Retry-After:
              schema:
                type: integer
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  responses:
    Unauthorized:
      description: Authentication required
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
    Forbidden:
      description: Insufficient permissions
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ErrorResponse'
  schemas:
    DataEnvelope:
      type: object
      properties:
        data:
          description: Response payload (shape varies by endpoint)
    ErrorResponse:
      type: object
      required:
      - error
      properties:
        error:
          type: string
        code:
          type: string
          description: Machine-readable error code (e.g., TRIAL_EXPIRED, PLAN_LIMIT_REACHED)
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: 'API key authentication. Generate keys in Settings > API Keys.

        Keys use the `cdy_` prefix.


        Example: `Authorization: Bearer cdy_a1b2c3d4e5f6...`

        '
x-mcp:
  transport:
  - stdio
  - http
  orchestration: code
  endpoint_tools: hidden