API overview and authentication

The server-to-server API uses this base URL:

https://dashboard.verbatik.com/api/v1/workspaces/WORKSPACE_ID

Create a key

Open Settings → API keys in the intended workspace. Choose a descriptive name, the minimum scopes, an expiry within the next year and a per-minute request limit. Save the full token securely when it is shown; the stored key list does not reveal it again.

Send it only from your server:

curl 'https://dashboard.verbatik.com/api/v1/workspaces/WORKSPACE_ID/agents' \
  -H "Authorization: Bearer $VERBATIK_API_KEY"

Tokens currently have the compatibility prefix ca_live_. Do not rename the token or place it in browser code, widget markup or URL query strings.

Scopes

• agents:read, agents:write
• calls:read, calls:write
• contacts:read, contacts:write
• campaigns:read, campaigns:write
• knowledge:read, knowledge:write
• billing:read

Each key belongs to one workspace. The issuer must retain the corresponding active workspace permission. Revoking a key, expiring it or removing the issuer’s access prevents further use. Write permission is rechecked rather than assumed from the original key creation.

Dashboard routes are separate

/api/verbatik/WORKSPACE_ID/... is the canonical namespace for dashboard session endpoints and specific public callbacks/widget routes. A bearer key does not turn every dashboard route into a public API. Do not automate internal integration, onboarding or settings routes using a copied browser session.

Responses and limits

Success responses wrap results in { "data": ... }. Errors use { "error": "message" }; validation errors may also include details. Read responses are private and not cached.

The saved key limit is 1–600 requests per minute, default 60. A 429 response means wait for the next minute before retrying. Call capacity, carrier throughput and outbound policy limits are separate from API request limits.

See Errors and retries, Contacts, Agents, Outbound calls and Webhooks.