OutboundSync API

When to use this guide: Use this section when you want a programmatic way to verify an OutboundSync API key, inspect which CRM connections it can access, or help an AI coding assistant build against OutboundSync.

The OutboundSync API is the developer surface for OutboundSync itself. It is separate from the Smartlead, Instantly, EmailBison, HeyReach, and other platform API keys you save so OutboundSync can read from those tools.

The API is in Beta. The v1 endpoints are stable and read-only; we may add fields and endpoints as the surface grows. Every endpoint is documented in the API v1 reference.

Base URL

https://app.outboundsync.com/api/v1

All current API routes live under /api/v1 and use Bearer authentication.

Authorization: Bearer osapi_<your-secret>

Endpoints

The public API uses sources → destinations vocabulary instead of the overloaded word “webhook”: a source is an inbound URL you paste into a sequencer, and a destination is a URL OutboundSync forwards received events to.

Endpoint	Purpose
`GET /api/v1/me`	Bootstrap call: validate the key, list accessible CRM connections, and discover related endpoints via `links`.
`GET /api/v1/account/status`	Pipeline readiness: is OutboundSync ready to receive events and sync them right now? Returns `blockers[]` and `warnings[]`.
`GET /api/v1/connections`	CRM connections with OAuth status and plan capabilities.
`GET /api/v1/sources`	Inbound paste URLs, platform config, and destination bindings.

See the API v1 reference for full request and response contracts, status codes, and the security model.

Just need to check whether the platform itself is up? The public, unauthenticated Platform health endpoints (GET /health/live and GET /health/ready) report availability without an API key.

Start here

Creating API keys Create, store, rotate, revoke, and scope OutboundSync API keys from the admin app.

API v1 reference Full contract for every endpoint, the sources and destinations vocabulary, status codes, and security.

Platform health endpoints Public /health endpoints to monitor OutboundSync availability — no API key required.

Errors and rate limits Handle invalid keys, disabled API access, rate limits, and retry behavior.

Authentication flow

Sequence diagram showing a client calling GET /api/v1/me with a Bearer API key, OutboundSync applying an IP rate limit, validating the key hash, resolving API-enabled CRM connections, and returning a MeResponse. — How OutboundSync validates an API key before returning account and connection details.

Quick test

Use GET /api/v1/me as the first request for a new integration. A successful response proves the key is valid and tells you whether the key is account-wide or scoped to one CRM connection.

curl https://app.outboundsync.com/api/v1/me \
  -H "Authorization: Bearer osapi_<your-secret>"

Ask an AI coding assistant

Paste this prompt into Cursor, Claude Code, Codex, or another coding assistant after you create an API key:

Verify my OutboundSync API key against GET https://app.outboundsync.com/api/v1/me.
Docs: https://outboundsync.com/docs/api/v1/
Use Bearer authentication. Parse the connections array and tell me which CRM connections this key can access.

OutboundSync docs pages also have mirrored Markdown endpoints under /content/docs/...md/, so coding assistants can retrieve the same reference content in a machine-readable form.