Today you extend UNOBITS through Automations — inbound webhook triggers, multi-step Flows and signed outgoing webhooks — with Donna’s Code mode writing the glue. A public REST API with scoped keys and SDKs is in developer preview: the explorer below shows its planned shape.
A simulated explorer for the public REST API in development. Requests here return sample responses — nothing touches a real workspace, and endpoints may change before release.
Test endpoints interactively and view native code snippets across languages.
curl -X POST "https://api.unobits.app/v1/workspaces/deals" \
-H "Authorization: Bearer uno_live_8f32dae0" \
-H "Content-Type: application/json" \
-d '{
"deal_name": "Acme Global Enterprise Expansion",
"value": 45000,
"currency": "USD",
"pipeline_stage": "proposal_review",
"contact": {
"name": "Sarah Connor",
"email": "sarah@acmeglobal.com"
}
}'Click Send Request above or switch tabs to see a sample response.
Available today: an owner-level setting registers outgoing webhooks with a signing secret, and Automations can start from inbound webhooks. Use the studio to see how verifying a signature works.
Zero polling. Receive instant JSON webhooks with cryptographic HMAC-SHA256 signatures directly on your backend servers.
{
"event": "crm.deal.won",
"event_id": "evt_9021a88b",
"created_at": "2026-08-09T00:00:00.000Z",
"data": {
"deal_id": "deal_98f310a2bc",
"deal_name": "Acme Global Enterprise Expansion",
"amount": 45000,
"currency": "USD",
"owner": {
"name": "Jordan Hayes",
"email": "jordan@unobits.app"
},
"account": {
"id": "acc_7710a",
"name": "Acme Corp"
},
"actions_triggered": [
"provision_client_portal",
"slack_victory_ping"
]
}
}Every webhook request includes an x-unobits-signature header to guarantee payload authenticity and prevent replay attacks.
const crypto = require('crypto');
function verifyWebhookSignature(payload, signatureHeader, secret) {
const [tPart, v1Part] = signatureHeader.split(',');
const timestamp = tPart.split('=')[1];
const signature = v1Part.split('=')[1];
const hmac = crypto
.createHmac('sha256', secret)
.update(`${timestamp}.${payload}`)
.digest('hex');
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(hmac));
}If your endpoint returns a non-2xx status code or times out, UNOBITS automatically retries with exponential backoff before sending events to the Dead Letter Queue.
The planned permission model for API keys — read/write scopes for CRM, Inbox, Finance, Projects and Donna, mirroring the permissions people already have in Admin.
Never grant full admin privileges to microservices. Check fine-grained scopes to issue scoped tokens with minimum required permissions.
deals:readFetch deal pipelines, contacts, and historical stage logs.
deals:writeCreate deals, update pipeline stages, and update contact records.
inbox:readAccess customer message threads across Email, Slack, WhatsApp, and SMS.
inbox:replySend outbound emails or chat responses directly into client threads.
finance:readInspect invoices, payments, recurring retainers, and accounting balances.
finance:writeGenerate invoices, trigger payment links, and record client transactions.
workflows:executeTrigger async tasks, task assignments, and multi-step business logic.
ai:dispatchInvoke Donna AI to generate executive briefings and summarize threads.
portals:adminProvision white-label client portal access links and expire sessions.
Store API keys strictly in server environment variables or KMS vaults. Keys with finance:write should never be exposed in client JS bundles.
How the client libraries are intended to look once the public API ships. They are not published yet.
Maintained and auto-generated daily from our latest OpenAPI 3.1 schema.
Production-ready snippets for handling webhooks, route handlers, and middleware in your framework of choice.
// src/app/api/webhooks/unobits/route.ts
import { NextResponse } from 'next/server';
import { UnobitsClient, verifyWebhookSignature } from '@unobits/sdk';
const unobits = new UnobitsClient({ apiKey: process.env.UNOBITS_API_KEY! });
export async function POST(req: Request) {
const rawBody = await req.text();
const signature = req.headers.get('x-unobits-signature') || '';
const isValid = verifyWebhookSignature(rawBody, signature, process.env.UNOBITS_WEBHOOK_SECRET!);
if (!isValid) {
return NextResponse.json({ error: 'Invalid HMAC signature' }, { status: 401 });
}
const payload = JSON.parse(rawBody);
if (payload.event === 'crm.deal.won') {
// Auto-trigger client portal setup
await unobits.portals.sessions.create({ dealId: payload.data.deal_id });
}
return NextResponse.json({ received: true });
}The planned surface of the public API, by domain. Subject to change before release.
Provision a deal record, bind contact information, and initiate pipeline automations.
| Field | Type | Required | Description |
|---|---|---|---|
| deal_name | string | Yes | Name of the deal opportunity. |
| value | number | Yes | Monetary value of the deal. |
| pipeline_stage | string | Optional | Stage slug (e.g. proposal, won). |
| contact | object | Optional | Associated primary contact details. |
{
"id": "deal_98f310a2bc",
"status": "active",
"deal_name": "Acme Enterprise",
"value": 45000,
"currency": "USD"
}Targets for the public API once it is released — illustrative until then. For today’s reliability, see the status page.
Target for the public API
Served from Cloudflare’s network
Secret per endpoint
Limits set at release
Import our complete endpoint definition directly into Stainless, Fern, Swagger, Insomnia, or Postman to auto-generate client SDKs and mock servers.