Skip to main content

Teloring API

Everything an agent can do in the console, your systems can do over HTTPS: conversations across every channel, the CRM behind them, the automations, the knowledge bases, the numbers — and, when you need it, a way to drop one of your own users straight into a specific chat.

https://api.teloring.com/v1

Five minutes to your first call​

1. Create a credential. In the console, go to Settings → API and press New credential. Give it a name, choose an expiry (or leave it unlimited), and tick the scopes it needs. Each scope unlocks a whole feature area — grant only what you will use.

2. Copy the client secret. It is shown once, at creation, and never again. If you lose it, revoke the credential and create another; the client id stays visible forever, so you can always tell which credential is which.

3. Get a token.

curl -X POST https://api.teloring.com/v1/oauth/token \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "tlc_811fc5491673d78d047a1085da2e22b7",
    "client_secret": "tls_9f3c8a21b6d54e7f90a1c2b3d4e5f60718293a4b5c6d7e8f"
  }'
{
  "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "expires_at": "2026-08-20T11:24:31+00:00",
  "scopes": ["conversations", "messages", "customers"],
  "account_id": "42"
}

4. Call something.

curl https://api.teloring.com/v1/conversations?status=open \
  -H "Authorization: Bearer $ACCESS_TOKEN"

5. Send a message.

curl -X POST https://api.teloring.com/v1/conversations/387/messages \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"type": "text", "content": "Thanks — we are on it."}'

That is the whole shape of the API. Everything else is more endpoints.

The things worth knowing up front​

There is no account id in any path. Your token already identifies the account. That is not a convenience — it is what makes reaching another business's data unrepresentable rather than merely forbidden.

Scopes are checked on every request, against live data. Remove a scope in the console and the very next call fails, without waiting for the token to expire.

This is a server-side API. No CORS headers are sent, deliberately: a token in browser JavaScript is a token in your page source. Call it from your backend.

Some calls cost money. Creating an agent takes a seat and may charge the card on file; WhatsApp templates, outbound SMS and signing links cost credits. Every such endpoint says so, in bold, at the top of its description.

Everything you write is audited. Each mutation is recorded with the credential that made it, so "what changed this?" always has an answer. See Audit log.

IP restrictions apply. If the account limits access by IP under Settings → Security & login, that limit covers the API too — see IP restrictions.

Where to go next​

AuthenticationTokens, rotation, and what each failure means
ScopesWhat every scope unlocks, and how to choose
Pagination, filtering & errorsThe conventions every endpoint follows
SSO loginSigning your users into the console, standalone or in an iframe
Postman collectionImport all 115 endpoints and start clicking

Then browse the endpoint reference in the sidebar — every operation has its parameters, request body, response schema and a runnable example.