STATXE Developers

Build with secure messaging, contacts, broadcasts, and automation APIs.

Create a key, validate it against /api/v1/me, copy a request, and move to production without waiting on support.

Open docs.statxe.com Get API key Download OpenAPI

Live

Use the REST API

Call inbox, outbox, contact, segment, and webhook endpoints from your backend.

Live

Receive Webhooks

Subscribe to contact, broadcast, email, and compliance events with signed delivery.

Portal only

Request assistant approval

Approved orgs get assistant recipes inside the authenticated portal, not the public docs.

Canonical

Public docs site

Guides, recipes, Scalar reference, and error catalog live at docs.statxe.com.

Visit docs

Developer docs sections

Getting Started

Start with the smallest working integration, then add production controls.

1. Create a scoped API key.
Use the portal to create a stx_ key with only the scopes your integration needs.
2. Validate it with /api/v1/me.
The response confirms org, key id, scopes, and rate-limit profile.
3. Make one read request.
Start with contacts, inbox threads, broadcasts, or webhook delivery logs.
4. Add idempotent writes and webhooks.
Use retry-safe writes and signed webhooks before going live.

Manage API keys Open raw OpenAPI JSON

Authentication

Every public API call uses a bearer API key created for the public API audience.

Send the key in the Authorization header. Do not put keys in query strings, logs, or frontend bundles you do not control.

Public keys authorize only the versioned /api/v1 surface. They do not grant access to older portal routes or internal assistant systems.

Production key handling

Store keys server-side, rotate them during off-hours, and create separate keys for test, staging, and production jobs.

curl https://api.statxe.com/api/v1/me \
  -H "Authorization: Bearer stx_live_xxx"

Scopes

Filter the scope catalog and confirm the exact scope required by each endpoint.

me:readmereadpublic

Inspect the current API key, org, scopes, and rate-limit profile.

domains:readdomainsreadpublic

Read verified sending domains and available sender identities.

inbox.threads:readinboxreadpublic

Read inbox threads, messages, and delivery events.

inbox.threads:writeinboxwritepublic

Update inbox thread/message state such as read, starred, archived, and tags.

outbox.broadcasts:readoutboxreadpublic

Read outbox broadcasts, campaign drafts, schedules, and send status.

outbox.broadcasts:writeoutboxwritepublic

Create and update broadcast drafts and schedules.

outbox.broadcasts:sendoutboxsendpublic

Launch or cancel broadcast/send lifecycle operations.

outbox.transactional:sendoutboxsendpublic

Send individual transactional emails via the API or the SMTP front door. Deliberately separate from outbox.broadcasts:send so an SMTP-only key cannot launch a broadcast.

contacts:readcontactsreadpublic

Read contacts and contact metadata.

contacts:writecontactswritepublic

Create, update, import, export, and delete contacts.

segments:readsegmentsreadpublic

Read segments, groups, and membership lists.

segments:writesegmentswritepublic

Create/update segments and manage contact membership.

webhooks:readwebhooksreadpublic

Read webhook endpoints and delivery status.

webhooks:writewebhookswritepublic

Create and update webhook endpoints.

webhooks:adminwebhooksadminpublic

Delete webhooks, rotate secrets, and replay deliveries.

api_keys:readapi_keysreadpublic

Read API key metadata.

api_keys:writeapi_keyswritepublic

Create and revoke API keys.

assistant.chat:writeassistantwritegated

Send gated assistant chat requests for admin-approved orgs.

assistant.tools:readassistantreadgated

Discover gated assistant tools available to an approved org.

assistant.sessions:readassistantreadgated

Read gated assistant session and usage state.

Endpoint scope map

GET/api/v1/me

Test an API key

me:read

GET/api/v1/contacts

List contacts

contacts:read

POST/api/v1/contactsIdempotent write

Create a contact

contacts:write

GET/api/v1/contacts/{id}

Retrieve a contact

contacts:read

PATCH/api/v1/contacts/{id}Idempotent write

Update a contact

contacts:write

DELETE/api/v1/contacts/{id}Idempotent write

Delete a contact

contacts:write

GET/api/v1/segments

List segments

segments:read

POST/api/v1/segmentsIdempotent write

Create a segment

segments:write

GET/api/v1/inbox/threads

List inbox threads

inbox.threads:read

GET/api/v1/outbox/broadcasts

List broadcasts

outbox.broadcasts:read

POST/api/v1/outbox/broadcastsIdempotent write

Draft a broadcast

outbox.broadcasts:write

GET/api/v1/webhooks

List webhook endpoints

webhooks:read

POST/api/v1/webhooksIdempotent write

Create a webhook endpoint

webhooks:write

GET/api/v1/webhooks/deliveries

List webhook delivery logs

webhooks:read

POST/api/v1/webhooks/deliveries/{id}/replayIdempotent write

Queue a webhook delivery replay

webhooks:admin

Errors

All errors use a stable envelope with a request id for debugging and support.

{
  "ok": false,
  "error": {
    "code": "missing_scope",
    "message": "The API key does not include the required scope.",
    "docs_url": "https://docs.statxe.com/api/errors/missing_scope"
  },
  "meta": {
    "request_id": "req_123"
  }
}

invalid_request

The request payload or query parameters are invalid.

invalid_api_key

The API key is missing, invalid, or expired.

missing_scope

The API key does not include the required scope.

not_found

The requested resource was not found.

conflict

The request conflicts with the current resource state.

rate_limited

The request exceeded the configured rate limit.

idempotency_conflict

The idempotency key was already used with a different request.

webhook_signature_invalid

The webhook signature is missing, expired, or invalid.

internal_error

An unexpected server error occurred.

Rate Limits

Limits are enforced per API key with a minute window, burst capacity, and retry guidance.

Default floor

Keys get at least 60 requests per minute.

Burst

Burst capacity is included and capped to keep traffic fair.

429 recovery

Respect Retry-After and retry with backoff.

Use the playground’s GET /api/v1/me preset to inspect the current key’s meta.rate_limit profile.

Idempotency

Mutating requests are designed to be safely retried without creating duplicate work.

Send an Idempotency-Key header on every POST, PATCH, and DELETE. Keys must be 8 to 128 characters.

Reusing the same key with the same request replays the stored response. Reusing it with different request content returns idempotency_conflict.

Generate keys from your job id, import row id, or queue message id so retries preserve the same operation identity.

Inbox API

Read inbox threads for syncing support and message workflows.

GET/api/v1/inbox/threads

List inbox threads

inbox.threads:read

Outbox API

Read broadcasts, create drafts, and keep sending operations behind explicit scopes.

GET/api/v1/outbox/broadcasts

List broadcasts

outbox.broadcasts:read

POST/api/v1/outbox/broadcastsIdempotency-Key

Draft a broadcast

outbox.broadcasts:write

Contacts API

Create, update, list, and delete contacts with cursor pagination and retry-safe writes.

GET/api/v1/contacts

List contacts

contacts:read

POST/api/v1/contactsIdempotency-Key

Create a contact

contacts:write

GET/api/v1/contacts/{id}

Retrieve a contact

contacts:read

PATCH/api/v1/contacts/{id}Idempotency-Key

Update a contact

contacts:write

DELETE/api/v1/contacts/{id}Idempotency-Key

Delete a contact

contacts:write

Webhooks

Subscribe to signed delivery events, track attempts, and replay failed deliveries.

Verify the timestamped t=...,v1=... signature.

Return 2xx only after durable processing.

Use delivery ids to dedupe retries and replays.

GET/api/v1/webhooks

List webhook endpoints

webhooks:read

POST/api/v1/webhooksIdempotency-Key

Create a webhook endpoint

webhooks:write

GET/api/v1/webhooks/deliveries

List webhook delivery logs

webhooks:read

POST/api/v1/webhooks/deliveries/{id}/replayIdempotency-Key

Queue a webhook delivery replay

webhooks:admin

const payload = await request.text()
const signature = request.headers.get("statxe-signature")

// Verify the timestamped v1 signature before trusting payload.
// Store event.id or delivery.id so retries are processed once.

Manage webhook endpoints

Assistant Access

Assistant APIs are gated and exposed inside the authenticated portal for approved orgs.

Assistant traffic must flow through the internal AI layer for policy, tool allowlists, usage budgets, audit logging, and provider abstraction before any broader external exposure.

If your org is approved, use the portal assistant experience instead of attempting direct public API calls.

Open Assistant