The Asks public API, plus outbound webhooks
A scoped, key-authenticated REST API for conversations, customers, tickets, and agent config — and signed webhooks that push events to your systems as they happen.
Everything the dashboard can see, your code can now see too. The public REST API covers conversations, customers, tickets, tags, channels, and agent configuration — authenticated with scoped API keys you manage in Settings, so an analytics script can't rewrite your prompts.
Prefer push over poll? Register a webhook endpoint and Asks sends signed events the moment they happen — new conversation, escalation, resolution, lead captured. Delivery logs, test events, and one-click secret rolling included.
curl https://api.asks.app/v1/conversations \-H "Authorization: Bearer ask_live_..."{ "data": [ { "id": "cnv_8f2...", "channel": "whatsapp","status": "resolved", "resolved_by": "ai" } ] }
Keys, scopes, environments
Keys are created under Integrations → API Keys: name it, pick Live or Test, and choose read-only or read & write. The full key is shown once — Asks stores only a SHA-256 hash. Scopes go finer than the presets when a key exists for a single purpose (agent:chat to talk to the agent, webhooks:manage for endpoints), and a request missing its scope tells you exactly which one it needed. Keys can carry an expiry, and revocation takes effect immediately.
A predictable surface
Everything lives under api.asks.app/v1, resolves the workspace from the key, and behaves the way you'd hope: cursor pagination on list endpoints, an Idempotency-Key header for safe POST retries, rate limits with standard RateLimit headers and a Retry-After on 429s, and one error envelope throughout. A machine-readable OpenAPI spec describes every endpoint.
Webhooks, done properly
Thirteen event types cover the lifecycle — conversations, messages, customers, tickets, SLA warnings and breaches, lead.captured, and agent.escalated. Deliveries are built to be trusted and debugged:
- Signed — every delivery carries a Stripe-style signature header (timestamp + HMAC-SHA256 over the raw body) so you can verify it came from Asks and reject stale replays.
- Retried— failures back off exponentially, up to 8 attempts; after 15 consecutive failures the endpoint is disabled and you're emailed.
- Inspectable — a delivery log you can browse and replay, a test action that sends a synthetic ping, and one-call secret rolling if a signing secret ever leaks.
See what's new in your workspace
Everything on this page is live today. Asks trains on your website and resolves customer conversations on every channel — free to try, live in minutes.