Developers
Public REST API (/v1/public/*) + outbound webhooks. Lihat docs di /api-docs.
Quickstart
2 steps to make your first API call.
- Create an API key at Settings → API Keys with scope
read:conversations. curl https://api.danum.ai/v1/public/conversations \ -H "Authorization: Bearer dnm_live_xxxxxxxx"
Webhooks
Subscribe to domain events like message.received.
Verify the signature with HMAC-SHA256:
import crypto from 'node:crypto';
function verify(secret: string, headerVal: string, body: string): boolean {
// headerVal: "t=1700000000,v1=hex..."
const parts = Object.fromEntries(
headerVal.split(',').map((p) => p.split('=') as [string, string])
);
const expected = crypto
.createHmac('sha256', secret)
.update(`${parts.t}.${body}`)
.digest('hex');
return crypto.timingSafeEqual(
Buffer.from(parts.v1, 'utf8'),
Buffer.from(expected, 'utf8')
);
}Manage webhooks →Standards
ADR-0022 (public API) + ADR-0023 (webhooks).
- Versioning in URL path (
/v1/). - Cursor pagination (
?cursor=&limit=). Idempotency-Keyheader for POST - replay window 24h.- RFC 7807-flavored error envelope.
- Webhook timeout 10s; 7 retries (30s → 24h).
- Signature
X-Danum-Signature: t=,v1=replay window 5 min. - Auto-disable webhook after 100 consecutive failures.
- Rotate secret with no downtime: old + new both active for 24h.