REST API
A small API, on purpose.
Enough to read the inbox and act on it — conversations, contacts, deals, tickets, and the four writes worth having. Not a general-purpose surface, because a public API is a promise and the smallest one that does the job is the cheapest promise to keep.
Most “open APIs” are a hundred endpoints nobody supports.
A large API is easy to publish and hard to keep. Every endpoint is a shape somebody is now depending on, and the ones added because an API “should have them” are the ones that break first and get deprecated quietly.
Token auth, revocable from Settings
A connection is authorised by an owner or admin and holds its own token. Revoke it and the integration is told to reconnect rather than left retrying for ever.
Reads that match the inbox
Messages, conversations, contacts, deals, tickets and labels — every one filtered through the same visibility rule the app itself applies. There is no mode where the API sees more than the person who authorised it.
Four writes, behind their own permission
Send a reply, add a label, write an internal note, create a follow-up. Sending is a separate scope, so a read-only connection stays read-only even if somebody changes their mind about what it was for.
Find a contact by number
Digits are compared, not strings, so any format matches. It is the endpoint every integration needs first and the one hand-built versions usually get wrong.
A rate limit per connection
Capped per minute, per token, because a token is the unit you can turn off. A runaway integration meets a wall rather than a bill.
What crosses over
- Conversations, messages, contacts, deals, tickets and labels, newest first, with a timestamp cursor.
- Your workspace name and plan, so an integration can tell two workspaces apart.
- Webhook subscriptions, so a client can register its own endpoint rather than asking somebody to paste one.
What never does
- Anything the authorising person cannot see. Every read goes through the same filter the inbox does.
- Internal notes on a message feed, and private conversations at all.
- A write from a connection that was not granted sending. It is refused with a sentence saying so, not a generic error.
Integrations are a Pro capability. Starter does not include HubSpot, Pipedrive, Zapier, webhooks or the API.
When you would use it
- Building an internal dashboard over the inbox without exporting anything.
- Wiring a bespoke system that neither connector nor Zapier covers.
- Letting an in-house tool raise a follow-up when its own conditions are met.
- Auditing what a workspace actually holds before committing to it.
What this leans on
Questions people ask
Which plan is this on?
Pro. Integrations — HubSpot, Pipedrive, Zapier, webhooks and the API — are a Pro capability, and Starter does not include them.
Is there a bigger API coming?
Only where something concrete needs it. The current endpoints exist because a Zapier app needs exactly these; adding more without a caller would be publishing promises we then have to keep.
Can the API see a private conversation?
No. A token identifies one person, and it sees precisely what that person sees in the inbox — private chats included in that, which is to say excluded from both.
What about AI tools rather than code?
MajlisDesk also speaks MCP, which is how an AI client connects to a workspace with scoped, revocable access. That is a separate door with its own page.