Build on Origin Platform

One REST API for all eight AI products: contacts, conversations, bookings, leads, calls, tickets, reviews, prospects, documents, records, posts, knowledge and metrics. Webhooks tell your systems the moment something happens.

Quick start

List your newest leads, then create one:

curl "https://app.originpixel.in/api/v1/leads?limit=25&stage=..." \
  -H "Authorization: Bearer $ORIGIN_API_KEY"

curl -X POST "https://app.originpixel.in/api/v1/leads" \
  -H "Authorization: Bearer $ORIGIN_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"name":"Website enquiry - dental implant","source":"website","value_estimate":45000,"currency":"INR"}'

Authentication

Every request needs Authorization: Bearer <key>. Keys start with opk_live_ and belong to one business; everything you read or write is limited to that business. We store only a SHA-256 hash, so a lost key cannot be shown again: revoke it and make a new one. Keys can expire, can be limited to IP addresses (CIDR ranges) and have their own rate limit. Third-party apps use OAuth 2.0 instead.

Scopes

Each product has a read and a write scope (leads are in revenue_engine:read). Write includes read. A scope never opens a product that is not in the package.

• contacts:read|write Contacts
• front_desk:read|write AI Front Desk (conversations, messages, bookings, knowledge)
• revenue_engine:read|write AI Revenue Engine (leads, campaigns)
• voice:read|write AI Voice Workforce (calls, call campaigns)
• customer_experience:read|write AI Customer Experience (tickets, reviews)
• sales:read|write AI Sales Workforce (prospects)
• business_intelligence:read|write AI Business Intelligence (metrics)
• back_office:read|write AI Back-Office Workforce (documents, records)
• content:read|write AI Content Studio (posts)

Pagination, filters and sorting

Lists return { object: "list", data, has_more, next_cursor }. Pass ?cursor=<next_cursor> for the next page and keep the same sort and filters. limit is 1-100 (default 25). Cursors are stable: new rows never shift a page.

GET /api/v1/leads?stage[in]=new,qualified&created_at[gte]=2026-11-01&sort=-last_activity_at&limit=50
GET /api/v1/contacts?tags[contains]=vip&name[search]=priya
GET /api/v1/tickets?status[neq]=closed&priority=urgent

Idempotent writes

Send Idempotency-Key: <unique value> with POST, PATCH and DELETE. A retry with the same key within 24 hours returns the first response (with Idempotent-Replayed: true) instead of creating a duplicate. The same key with a different body returns 422; while the first request is still running you get 409 with Retry-After.

Rate limits

Each key has a per-minute limit (default 120). Every response has RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset (seconds) and RateLimit-Policy. Over the limit you get 429 with Retry-After; wait that many seconds. The SDKs retry automatically.

Errors

Errors are RFC 9457 problem details (application/problem+json) with a stable code, a human detail and the request_id. Validation errors list each field in errors. See all codes.

Versioning and deprecation

The version is in the path (/api/v1) and every response carries API-Version: 2026-11-01. Within v1 we only add fields, endpoints and events. Before anything is removed it is marked with the Deprecation header (RFC 9745), a Sunset date (RFC 8594, at least 6 months) and a Link to its successor. Example: /api/v1/kb-articles is deprecated in favour of /api/v1/knowledge-articles.

OpenAPI

The full OpenAPI 3.1 document is at /api/v1/openapi.json. Import it into Postman, Insomnia or your code generator. Typed SDKs for TypeScript and Python are in SDKs.

Privacy and security

You are a processor of your customers' personal data (DPDP Act 2023, GDPR). Ask only for the scopes you need, keep keys in a secret manager, rotate them, and delete data you no longer need (DELETE /api/v1/contacts/{id}). Every key creation, revocation and change is in the audit log; every request is in Developers > Request logs for 30 days.