Kintara API

Create a key in Settings → Developers (or, for an agency, on the agency portal’s API page), pick its scopes and copy it: it is shown only once. Then:

curl https://kintara-j2gv.vercel.app/api/v1/me \
  -H "Authorization: Bearer $KINTARA_API_KEY"

All requests and responses are JSON over HTTPS. Base URL: https://kintara-j2gv.vercel.app/api/v1. Times are ISO 8601 in UTC, phone numbers E.164, money in cents.

Send the key as a bearer token: Authorization: Bearer <key>. A missing, invalid or revoked key gets 401 with a WWW-Authenticate: Bearer header; a key without the scope an endpoint needs gets 403 insufficient_scope. Keys can be revoked at any time from the same page.

A key made inside a sub-account always acts on that organization. An agency key can act on any of the agency’s sub-accounts: name the one you mean with the Kintara-Organization header or the organization_id query parameter. List them with GET /organizations. Endpoints marked “Organization required” answer 400 organization_required when an agency key names none, and 403 for an organization outside the agency.

curl "https://kintara-j2gv.vercel.app/api/v1/calls?limit=10" \
  -H "Authorization: Bearer $KINTARA_API_KEY" \
  -H "Kintara-Organization: 0b6f2c1e-7d3a-4e8b-9c5f-1a2b3c4d5e6f"

Requests are counted per one-minute window: 600 per minute shared by an agency’s keys (the agency’s plan can raise it) and 120 per minute for a sub-account’s own keys. Every response carries:

• X-RateLimit-Limit: requests allowed in the window
• X-RateLimit-Remaining: requests left in it
• X-RateLimit-Reset: Unix time (seconds) the window resets

Over the limit you get 429 rate_limited with a Retry-After header in seconds; wait that long before retrying. GET /me shows your current limit.

List endpoints return the newest first, 25 per page by default. Set limit (1 to 100) and pass the previous page’s next_cursor as cursor until has_more is false.

{
  "data": [ ... ],
  "has_more": true,
  "next_cursor": "eyJ0IjoiMjAyNi0xMS0wNlQxNTowNDowNS4wMDBaIiwiaSI6Ii4uLiJ9"
}

The major version is part of the URL (/api/v1) and every response carries a Kintara-Api-Version header. Additive changes (new fields, endpoints, optional parameters and webhook event types) ship in place, so ignore fields you do not know. Breaking changes only ship as a new major version.

• A deprecated version answers with Deprecation, Sunset and Link headers and stays available for at least 180 days after it is deprecated.
• GET /api/versions lists every version and its status: /api/versions.
• An unknown version (for example /api/v2/calls) returns 404 unsupported_api_version.
• Every change is announced in the changelog.

Errors use the HTTP status and a JSON body with a stable code:

{
  "error": {
    "code": "invalid_parameter",
    "message": "limit must be between 1 and 100.",
    "details": { "param": "limit" }
  }
}

• 400 invalid_request, invalid_parameter, organization_required
• 401 unauthorized: missing, invalid or revoked key
• 403 forbidden, insufficient_scope
• 404 not_found: no such record in this organization
• 429 rate_limited; 500 server_error (safe to retry)

Paths are relative to https://kintara-j2gv.vercel.app. Endpoints marked with an organization also take Kintara-Organization / organization_id.

Subscribe an https URL with POST /webhooks (or in Settings → Developers). Kintara then POSTs each matching event to it as JSON:

{
  "id": "8f0c5a8e-2b7e-4f6a-9d0e-3f1c2b4a5d6e",
  "type": "call.completed",
  "created_at": "2026-11-06T15:04:05.000Z",
  "organization_id": "0b6f2c1e-7d3a-4e8b-9c5f-1a2b3c4d5e6f",
  "data": {
    "call_id": "c1a2b3d4-e5f6-4789-8abc-def012345678",
    "status": "completed",
    "duration_seconds": 184
  }
}

Every delivery carries these headers:

• X-Kintara-Signature: v1= + hex HMAC-SHA256 of "<timestamp>.<raw body>", keyed with the endpoint’s secret
• X-Kintara-Timestamp: Unix time (seconds) of signing; reject anything older than a few minutes
• X-Kintara-Event: the event type
• X-Kintara-Delivery: the delivery id

Answer with any 2xx within 10 seconds. Other answers and timeouts are retried with growing delays, up to 8 attempts; delivery is at-least-once, so de-duplicate on the payload’s id, which stays the same across retries. Answering 410 Gone disables the endpoint, and an endpoint is disabled automatically after 20 failed deliveries in a row (re-enable it in Settings → Developers).

Verifying the signature (Node.js)

import crypto from "node:crypto";
import express from "express";

const app = express();

// Keep the raw body: the signature covers the exact bytes we sent.
app.post("/kintara/webhooks", express.raw({ type: "application/json" }), (req, res) => {
  const secret = process.env.KINTARA_WEBHOOK_SECRET; // from POST /api/v1/webhooks
  const timestamp = req.get("X-Kintara-Timestamp") ?? "";
  const signature = req.get("X-Kintara-Signature") ?? "";
  const body = req.body.toString("utf8");

  const expected =
    "v1=" + crypto.createHmac("sha256", secret).update(`${timestamp}.${body}`).digest("hex");
  const valid =
    signature.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
  const fresh = Math.abs(Date.now() / 1000 - Number(timestamp)) < 300; // 5 minutes

  if (!valid || !fresh) return res.status(400).send("Invalid signature");

  const event = JSON.parse(body); // { id, type, created_at, organization_id, data }
  // Deliveries are at-least-once: skip event.id values you have already handled.
  res.sendStatus(200); // answer quickly, do slow work in the background
});

Event types

Leave event_types empty to receive every event. GET /event-types returns this list.

The webhook endpoints follow the REST hooks pattern, so a Zapier or Make app can use instant triggers with an API key (scope webhooks:manage):

• Subscribe: POST /api/v1/webhooks with { "target_url": "...", "event_type": "lead.created", "source": "zapier" }. Store the returned id.
• Unsubscribe: DELETE /api/v1/webhooks/{id} when the Zap or scenario is turned off.
• Sample data: GET /api/v1/events?type=lead.created&sample=1 returns recent events in the exact webhook payload shape, or realistic samples when the account has none yet. It also works as a polling trigger.
• Cleanup: if the hook URL answers 410 Gone, Kintara disables the subscription and stops sending.

curl -X POST https://kintara-j2gv.vercel.app/api/v1/webhooks \
  -H "Authorization: Bearer $KINTARA_API_KEY" \
  -H "Kintara-Organization: 0b6f2c1e-7d3a-4e8b-9c5f-1a2b3c4d5e6f" \
  -H "Content-Type: application/json" \
  -d '{"target_url":"https://hooks.zapier.com/hooks/standard/123/abc","event_type":"lead.created","source":"zapier"}'

Questions or a missing endpoint? Write to privacy@kintaragroup.com.