REST API

Everything the dashboard does is API-first. Interactive OpenAPI reference: /docs on your API host (generated from the same zod schemas that validate requests).

Authentication

Authorization: Bearer eng_live_...

Keys are org-scoped or app-scoped, with read / write / send / admin scopes. Rate limiting is per key.

Route map (all under /v1)

Area	Routes
Orgs	POST /orgs (admin bootstrap) · GET/PATCH /org · usage, invoice preview, audit log
Apps & credentials	apps CRUD · POST /apps/:id/credentials/{fcm,apns,whatsapp,telegram,rcs} · settings (caps, quiet hours, webhook, email sender)
Audience	subscribers (upsert on external id), devices, tags, bulk import
Segments	CRUD + live preview counts
Messaging	messages (incl. localizations) · campaigns (recurrence, tz, optimal-time, throttle, A/B) · POST /campaigns/:id/send
Transactional	POST /apps/:id/notifications — straight to the priority lane
Journeys	CRUD + PATCH {active} + stats
Live Activities	list · POST /live-activities/:id/{update,end}
Insights	funnel, cohorts, RFM
Integrations	catalog GET · per-type PUT/DELETE
Billing	GET /org/billing · POST /org/billing/checkout (Stripe-hosted)
White-label	POST/GET /org/clients · GET/PATCH /org/branding

Public SDK endpoints (appId-scoped, no key)

GET /sdk/app/:appId · POST /sdk/subscriber · POST /sdk/register · POST /sdk/tags · POST /sdk/live-activities · in-app feed — these only let a client create/claim its own records within one app.

Ingest

POST /e on the ingest host: batched events with per-event validation (one malformed event never poisons a batch). Plus POST /i/segment/:appId for Segment inbound.

AI agents

@wingblaze/mcp-server exposes send_campaign, campaign_stats, send_transactional and org_usage as MCP tools — point your agent at it and it can operate WingBlaze directly.