עמוד קנוני: https://docs.teloring.com/he/api/ עודכן לאחרונה: 2026-08-20T20:49:57.000Z # Teloring API Everything an agent can do in the console, your systems can do over HTTPS: conversations across every channel, the CRM behind them, the automations, the knowledge bases, the numbers — and, when you need it, a way to drop one of your own users straight into a specific chat. ``` https://api.teloring.com/v1 ``` ## Five minutes to your first call **1. Create a credential.** In the console, go to **Settings → API** and press **New credential**. Give it a name, choose an expiry (or leave it unlimited), and tick the scopes it needs. Each scope unlocks a whole feature area — grant only what you will use. **2. Copy the client secret.** It is shown once, at creation, and never again. If you lose it, revoke the credential and create another; the client id stays visible forever, so you can always tell which credential is which. **3. Get a token.** ```bash curl -X POST https://api.teloring.com/v1/oauth/token \ -H "Content-Type: application/json" \ -d '{ "client_id": "tlc_811fc5491673d78d047a1085da2e22b7", "client_secret": "tls_9f3c8a21b6d54e7f90a1c2b3d4e5f60718293a4b5c6d7e8f" }' ``` ```json { "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9…", "token_type": "Bearer", "expires_in": 3600, "expires_at": "2026-08-20T11:24:31+00:00", "scopes": ["conversations", "messages", "customers"], "account_id": "42" } ``` **4. Call something.** ```bash curl https://api.teloring.com/v1/conversations?status=open \ -H "Authorization: Bearer $ACCESS_TOKEN" ``` **5. Send a message.** ```bash curl -X POST https://api.teloring.com/v1/conversations/387/messages \ -H "Authorization: Bearer $ACCESS_TOKEN" \ -H "Content-Type: application/json" \ -d '{"type": "text", "content": "Thanks — we are on it."}' ``` That is the whole shape of the API. Everything else is more endpoints. ## The things worth knowing up front **There is no account id in any path.** Your token already identifies the account. That is not a convenience — it is what makes reaching another business's data unrepresentable rather than merely forbidden. **Scopes are checked on every request, against live data.** Remove a scope in the console and the very next call fails, without waiting for the token to expire. **This is a server-side API.** No CORS headers are sent, deliberately: a token in browser JavaScript is a token in your page source. Call it from your backend. **Some calls cost money.** Creating an agent takes a seat and may charge the card on file; WhatsApp templates, outbound SMS and signing links cost credits. Every such endpoint says so, in bold, at the top of its description. **Everything you write is audited.** Each mutation is recorded with the credential that made it, so "what changed this?" always has an answer. See [Audit log](/api/list-audit-log). **IP restrictions apply.** If the account limits access by IP under Settings → Security & login, that limit covers the API too — see [IP restrictions](./guide-authentication#ip-restrictions). ## Where to go next | | | | --- | --- | | [Authentication](./guide-authentication) | Tokens, rotation, and what each failure means | | [Scopes](./guide-scopes) | What every scope unlocks, and how to choose | | [Pagination, filtering & errors](./guide-conventions) | The conventions every endpoint follows | | [SSO login](./guide-sso) | Signing your users into the console, standalone or in an iframe | | [Postman collection](./guide-postman) | Import all 115 endpoints and start clicking | Then browse the endpoint reference in the sidebar — every operation has its parameters, request body, response schema and a runnable example.