Developer REST API & Scoped Tokens
Connect your existing data warehouse, CRM, and internal workflows to SiSender via our developer-first REST API. Mint SHA-256 hashed bearer tokens with granular, role-bounded permission scopes.
Unscoped Root API Keys
Traditional platforms issue master API keys with god-mode access across the entire account. If an integration script leaks that key, malicious actors can wipe databases or hijack mailboxes.
Plaintext Database Secrets
Storing raw API tokens in databases exposes credentials to internal breaches. SiSender implements cryptographic one-way SHA-256 hashing — keys are displayed once upon generation and never stored in plaintext.
Siloed Outbound Data
Without automated webhooks and endpoints, sales development activity remains trapped inside the cold email tool, leaving executive CRM dashboards blind to outbound engagement.
How Scoped API Tokens Function
Token Minting
Name your token (e.g. "HubSpot Sync" or "BI Ingestion") and select specific capability scopes. A user can only grant permissions that their own user role currently holds.
One-Time Display
The bearer key (e.g. si_live_...) is displayed once in a modal box. SiSender hashes the key using SHA-256 before saving to the database, making it mathematically impossible to recover if lost.
Bearer Authentication
Include the key in the standard HTTP header: Authorization: Bearer si_live_.... Requests are tenant-isolated and bounded to the token's scope list.
One-Click Revocation
If an external service is retired or a secret is rotated, revoke the token immediately from the console with zero downtime for other integrations.
API Tokens Console & cURL Showcase
Exact rebuild of engage_deploy_CHG0107/app/Views/apitokens/index.php showing active bearer tokens, scope tags, and cURL requests.
API Tokens
/api/v1 · SHA-256 hashed storage · role-bounded permissions| Token Name | Scoped Capabilities | Last Used | Status | Actions |
|---|---|---|---|---|
|
HubSpot & Salesforce Bidirectional Sync
Key identifier:
si_live_9f83...c21a |
prospects.view
prospects.import
pipeline.move
|
12 mins ago UTC | Live | |
|
Data Warehouse BI Ingestion
Key identifier:
si_live_44d1...8e0b |
campaigns.view
logs.view
prospects.view
|
1 hour ago UTC | Live | |
|
Legacy Webhook Relay
Key identifier:
si_live_12c9...55fa |
campaigns.view
|
14 days ago UTC | Revoked | Revoked 07/10/2026 |
-H "Authorization: Bearer si_live_9f83...c21a" \
-H "Content-Type: application/json" \
-d '{
"email": "elena.m@haldenrowe.co.uk",
"firstName": "Elena",
"lastName": "Marchetti",
"company": "Halden & Rowe"
}'
Developer API Capabilities Ledger
| Endpoint / Method | Function & Scope | Status | Code Reference |
|---|---|---|---|
POST /api/v1/prospects |
Programmatically insert new prospect records with custom attribute mapping. Requires prospects.import scope. |
COMPLETE | ProspectController::store |
POST /api/v1/campaigns/{id}/enrol |
Enrol a validated lead directly into an active multi-step sequence. Requires campaigns.edit scope. |
COMPLETE | CampaignController.php |
POST /api/v1/pipeline/{id}/move |
Transition a deal card between pipeline stages (e.g. to Meeting Booked or Won). Requires pipeline.move scope. |
COMPLETE | PipelineController::move |
GET /api/v1/telemetry/stats |
Extract hourly and daily delivery telemetry, open rates, and reply statistics for BI pipelines. | COMPLETE | DashboardController::kpis |