API Documentation

The API is in pre-launch. This reference is complete and public: every endpoint, field, error, code sample, connector and download is here, with no sign-in. Keys are not being issued to everyone yet: the in-app Console is open to preview accounts only, and opens to every paid and lifetime plan at launch. Read and build against the reference now, and sign in to check whether your account is already in the preview.
Interactive testing, your API keys, and your profile/workspace IDs light up in the in-app Console. While the API is in pre-launch that Console is open to preview accounts only. Sign in to open it.

Connect your tools

Connect an AI agent, an automation platform or your own application. Each connection gets its own key, its own Skills choices and its own history, and you can add as many as you need.

AI agents

ChatGPT Desktop/Codex
Recommended

One installation for ChatGPT Desktop and Codex.

Connect
Claude

Great for guided content workflows and teams.

Connect
Google Antigravity

One connection for the Antigravity desktop app, IDE and CLI.

Connect
Meta Muse

Meta's personal agent, connected with one prompt.

Connect

Automation platforms

Make.com

Best for visual automations, AI workflows, and multi-step scenarios.

Connect
n8n

Best for flexible technical workflows.

Connect
Power Automate

Best for Microsoft-based teams.

Connect
Zapier

Best for simple app-to-app automations.

Connect

Developer options

Postman

Test requests before building.

Connect
Custom API

Connect your own app or internal system.

Connect

Looking for webhooks? Event-driven automation lives under Webhook endpoints. Keys created from API keys appear here under Custom API.

Make your first post in 60 seconds

Here is exactly what a request looks like. In the in-app version you can run it right here (it creates a draft, so nothing is published), and your draft lands in your Publisher, ready to review, edit or schedule.

Safe to try: it only ever creates a draft, never publishes
1
This is what a request looks like. Replace PASTE_YOUR_API_KEY_HERE with your own API key in your tool's Authorization field. Nothing runs on this page, and you should never paste a key into a web page. The in-app Console injects it for you instead. Add a profile in your workspace settings and it will appear in Your IDs.
POST https://repute.sociamonials.com/api/v1/posts Authorization: Bearer PASTE_YOUR_API_KEY_HERE Content-Type: application/json { "mode": "draft", "message": "Hello from the API - this is a draft, nothing is published.", "networks": { "fb": { "profile_refs": [ "[your profile ID]" ] } } }
2
Send it. We run the request with your account's key behind the PASTE_YOUR_API_KEY_HERE. You never have to paste or handle it here.
Activate your live API keys in the app to run this.
In the app, Send creates a real draft using your key (never shown in your browser). Nothing publishes.
3
Open your Publisher. Your draft is waiting. When you're ready to automate for real, the same request works from any tool below.

Want to build it in a tool? See Connect your tools for Make, Zapier, n8n, and AI assistants like Claude and ChatGPT. Need the full endpoint list? See API Reference.

API keys

API keys authenticate every request. Each key acts with a chosen user's permissions, profile access and approval routing. Keys are created and managed inside your account. They are never shown on this public page.

Sign in and open the API Console to create, copy and manage your keys.
Who can create a key? API access is included with every paid and lifetime plan at no extra cost. It is not sold separately. Free trials are excluded: the Console opens but Create API Key sends you to choose a plan, and a credential belonging to a trial, lapsed or suspended account returns 402 api_subscription_inactive. The AgencyPro API additionally requires an active AgencyPro subscription on the primary agency workspace; without it that workspace gets the Workspace API instead. While the API is in pre-launch, keys are being issued to preview accounts first.
Keep your keys safe. A key is shown only once, when you create or rotate it. We store only a one-way hash and can never show it again. Paste a key only into a tool's dedicated API-key, secret, or Authorization field. Never paste it into a chat message, support ticket, screenshot, or document. If a key is exposed, revoke it and create a new one.

Webhooks

Send real-time events to your applications and automations.

Get started in 4 simple steps

1
Add an endpoint Enter your https URL and pick the events to send.
2
Copy your signing secret Shown once when you save. Use it to verify each delivery.
3
Send a test event Confirm your receiver gets it. The endpoint must be enabled.
4
Enable & monitor New endpoints start enabled: events flow while enabled. Watch results below and re-enable any that turn off.
Webhook notifications are configured here when you sign in.

Delivery contract & verifying signatures

Every delivery is an HTTPS POST with a JSON body in this envelope:

{
  "event_id": "evt_sm_…",        // stable across retries, deduplicate on this
  "type": "campaign.entry_received",
  "version": 1,                    // fields may be added; meanings never change within a version
  "created_utc": "2026-08-02T18:00:00+00:00",   // when it happened, not when delivered
  "workspace_registration_id": 12345,
  "workspace_name": "Client name",  // route per-client automations on these two
  "source": { "type": "api|ui|system", "credential_id": null },
  "data": { … }                  // the event's own fields
}

Headers: X-Webhook-Event (the type), X-Webhook-Event-Id, and X-Webhook-Signature as t=<unix>,v1=<hex> where v1 = HMAC-SHA256("<t>.<raw body>", your signing secret).

// verify (PHP), same idea in any language
[$t, $v1] = sscanf($_SERVER['HTTP_X_WEBHOOK_SIGNATURE'], 't=%d,v1=%s');
$expected = hash_hmac('sha256', $t . '.' . file_get_contents('php://input'), $secret);
$ok = hash_equals($expected, $v1) && abs(time() - $t) < 300; // reject > 5 min old
  • At-least-once: a delivery can arrive twice (retries after a lost response). Deduplicate on X-Webhook-Event-Id.
  • Ordering is not guaranteed: a retried event can arrive after a newer one; each event stands alone and carries created_utc.
  • Retries: a failed delivery is attempted up to 6 times in total (5 retries) over about 8.5 hours, always with the original payload. After 5 consecutive events exhaust every attempt, the endpoint is disabled automatically. This pane shows the reason, and re-enabling clears the failure count.
  • Self-echo: actions your own integration performs via the API come back as events with source.type = "api". Filter on it to avoid loops.
  • Ignore unknown fields: new fields may appear within a version; never reject a payload for carrying one.

Reference

Technical details for the API, MCP server, account IDs, and usage limits.

Every endpoint, with live examples. Send your key as Authorization: Bearer <key>. The Bearer prefix is optional. Read requests run right here with your key injected securely; nothing is ever shown or published.

Testing here only reads data or creates drafts: it never publishes and never shows your key

Troubleshoot an error

Paste the error from your API, AI agent, or automation tool. We'll identify the cause and show you how to fix it.

Credentials, tokens and personal details are removed before analysis: in your browser first, then again on the server. Nothing is run or published.
Analyze error
The error analyzer runs in the in-app version. Sign in to use it.

No error code? Start here.

Choose the symptom closest to what you're seeing.

GET /workspaces returned [] (no workspaces)
A workspace-type credential only sees the one workspace it is bound to, and only once that registration is provisioned as a workspace; an agency credential sees its estate. Check GET /api/v1/me. It shows your agent type and the workspaces the credential can reach. An empty list there means the credential has no assigned workspace yet, not that the call failed.
A post was accepted (200) but never publishes
Check three things: mode: a draft is saved, never published; approval: a post held for approval waits until someone approves it; and schedule: publish_at is ISO-8601 UTC, so a local time sent without a zone can land hours away. The post id from the create response, on your Publisher, shows its real state.
A webhook never arrives
A new endpoint is delivered to only while it is enabled: enable it (the Webhooks pane shows a prominent button when it is off). Then open GET /api/v1/webhooks/{id}/deliveries (the Recent activity feed on the Webhooks pane): every attempt is logged with its status and response. If you see nothing at all, the event you expect may not be in the endpoint's selected events; if you see failures, read the next two items.
Webhook signature won't verify
X-Webhook-Signature is t=<unix>,v1=<hex> where v1 = HMAC-SHA256("<t>.<raw body>", signing secret). Sign the raw request bytes (not re-encoded JSON), compare with a constant-time check, use the current secret (a rotate takes effect immediately), and reject deliveries whose t is more than 5 minutes old.
An endpoint was disabled after repeated failures
After 5 consecutive events exhaust every retry, the endpoint is turned off automatically. Fix your receiver (reachable over HTTPS, valid certificate, returns 2xx quickly), then re-enable it. Re-enabling clears the failure count. Events that occurred while it was off are not re-sent.

Error reference

Find an HTTP status or error code and see what it means and how to fix it.

Each endpoint lists the errors it returns in the API Reference. Paste a raw error into Troubleshoot above for a guided diagnosis.

HTTPerror.code What it meansWhat to do
400 credentials_in_query_string
The key was sent as a ?token=, ?api_key= or ?access_token= query parameter. That exposes it in logs and browser history, so the request is refused and the exposure is recorded.
Move the key into the Authorization header: Authorization: Bearer <key>. Then rotate that key. Treat it as exposed.
401 missing_credentials
No Authorization header reached the API.
Send Authorization: Bearer <key>. In no-code tools this is the connection or Header Auth credential, not a body field. Some proxies strip the header. Check your tool's header settings.
401 invalid_credentials
The credential is not valid. Unknown, revoked and expired keys are deliberately indistinguishable.
Confirm you pasted the whole key with no leading or trailing space. The Bearer prefix is optional. Both forms authenticate identically. If the key was revoked or rotated, create a new one in the Console.
402 api_subscription_inactive
The credential is valid, but API access is not active for this account: it is on a free trial, or its plan has lapsed or been suspended. API access is not sold separately - it is included with every paid and lifetime plan.
The account owner activates a paid plan; API access follows automatically. AgencyPro API credentials additionally need an active AgencyPro subscription. Without it the message says so, and a Workspace API credential still works.
403 permission_denied
The credential authenticated, but this API Agent has not been granted the permission the operation needs (for example posts.publish_direct, analytics.read or clients.provision).
Call GET /api/v1/me. It returns the full per-workspace permission map. A key restricted to one user never holds the agency-wide permissions (client workspaces, webhooks, workspace tags): use an unrestricted key for those. Otherwise use an operation you are allowed to call (for example create for approval instead of publishing directly).
403 workspace_access_denied
The workspace exists but this API Agent is not assigned to it.
Use GET /api/v1/workspaces to list the workspaces the credential can reach, or assign the workspace to the agent.
403 profile_not_assigned
You named a social profile in networks.<code>.profile_refs that this API Agent, or the user the credential is attached to, is not assigned to in that workspace. This is the most common first-integration failure.
List the workspace's profiles with GET /workspaces/{workspaceId}/social-profiles and use only those whose agent_can_publish_to is true. A profile that arrives via a post_preset is dropped with a warning for attached-user agents, but a profile you name explicitly always hard-fails.
403 attached_user_no_reports_permission
This credential is attached to a workspace user, and that user does not hold the "Access Reports" permission that analytics requires.
Grant "Access Reports" to that user in Workspace Users, then retry. Or use a credential that is not restricted to that user.
403 agency_agent_required
Client provisioning and the client lifecycle operations need an Agency API Agent. The credential you used is a Workspace API Agent.
Use an AgencyPro API credential from the primary agency workspace. That workspace needs an active AgencyPro subscription to be an AgencyPro API account at all.
403 agencypro_required
The credential is an AgencyPro API Agent, but client provisioning is an AgencyPro feature and this agency does not have an active AgencyPro subscription.
Reactivate AgencyPro on the agency. Publishing, sweepstakes and analytics for workspaces you already operate are unaffected.
403 client_not_owned
The workspace you targeted is not a client of this agency, or you aimed a client-lifecycle operation at the agency's own account, which is never allowed.
GET /workspaces lists the client workspaces this credential can operate. The agency's own workspace can never be paused or resumed through client lifecycle.
403 provision_limit_reached
This agency has already provisioned its daily maximum of new client workspaces.
Retry tomorrow, or have an administrator raise the per-agency daily provisioning limit. The message names the current cap.
403 api_write_operations_disabled
The administrator has turned the API write kill-switch on. Reads keep working; anything that would change data is refused.
Nothing to change in your integration. Retry once writes are re-enabled. Read endpoints are unaffected.
404 not_found
The post, job, sweepstakes or provisioning record does not exist, or it is not in a workspace this credential can read.
Re-check the id, and check the workspace: an id from another workspace looks exactly like a missing one.
405 method_not_allowed
The path is right and the method is wrong. The route exists for a different verb.
Check the method against the endpoint list on the left. Reading a post is GET /posts/{id}; cancelling it is DELETE /posts/{id}.
409 existing_account
The email you passed to client provisioning already has an account. Attaching an existing account to an agency is not supported yet.
Provision with an email that has no account. An existing workspace has to be linked to the agency outside the API.
409 idempotency_in_flight
A request carrying this idempotency_key is already being processed. This is the guard that stops a retry creating a second post.
Wait a moment and retry the same key. You will collect the original result rather than create a duplicate.
409 cannot_cancel
The post is no longer in a state that can be cancelled (it has already been sent, or already cancelled).
Read the post first and cancel only while it is still pending.
409 cannot_reissue
The provisioning handoff link cannot be reissued in its current state.
Read the provisioning record for its current state before reissuing.
422 validation_failed
The request reached the platform's validation pipeline and one or more fields were rejected. error.errors maps each field to its own problem.
Fix the named fields. This is the code a dry-run returns too, so you can validate without creating anything.
422 workspace_required
This credential could not be matched to a single workspace, so the API cannot tell which one the call should act on.
Pass workspace_registration_id. GET /workspaces lists the ones this credential can use.
422 unsupported_campaign_type
The campaign you referenced is not a V2 Viral Sweepstakes. The API only supports V2 Viral Sweepstakes, never contests or the legacy campaign builders.
Target a V2 Viral Sweepstakes, or create one with the sweepstakes endpoints.
429 rate_limited
The credential exceeded its per-minute read or write limit.
Wait for Retry-After seconds. X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset are on every response, so you can pace requests instead of retrying blind.
500 internal_error
An unexpected failure on the platform side, not a problem with your request.
Retry. This class of failure is treated as transient. If it persists, contact support and quote the request_id from the response.
503 api_access_disabled
The API is switched off platform-wide by the administrator. This is not about your account or your key.
Retry later; no change to your integration is needed.
4xx / 5xx http_error
The request failed at the HTTP layer before any endpoint logic could classify it: a malformed request, an unsupported media type, a request that never reached a controller. The response status tells you which.
Check the URL, method, headers and body encoding. If the same status keeps coming back, contact support and quote the request_id.

Standard error response format

API failures use this structure. Handle errors using code and include request_id when contacting support.

{ "error": { "code": "validation_failed", "message": "One or more fields are invalid.", "request_id": "9f1c...", "errors": { "message": "is required" } } }

Match on code, never on the message text. errors is present only on validation_failed, where it maps each field to its own problem. Rate-limited responses also carry Retry-After and the X-RateLimit-* headers.