Developers

Public REST API (/v1/public/*) + outbound webhooks. Lihat docs di /api-docs.

Quickstart

2 steps to make your first API call.

  1. Create an API key at Settings → API Keys with scope read:conversations.
  2. curl https://api.danum.ai/v1/public/conversations \
      -H "Authorization: Bearer dnm_live_xxxxxxxx"

Webhooks

Subscribe to domain events like message.received.

Verify the signature with HMAC-SHA256:

import crypto from 'node:crypto';

function verify(secret: string, headerVal: string, body: string): boolean {
  // headerVal: "t=1700000000,v1=hex..."
  const parts = Object.fromEntries(
    headerVal.split(',').map((p) => p.split('=') as [string, string])
  );
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${parts.t}.${body}`)
    .digest('hex');
  return crypto.timingSafeEqual(
    Buffer.from(parts.v1, 'utf8'),
    Buffer.from(expected, 'utf8')
  );
}
Manage webhooks →

Standards

ADR-0022 (public API) + ADR-0023 (webhooks).

  • Versioning in URL path (/v1/).
  • Cursor pagination (?cursor=&limit=).
  • Idempotency-Key header for POST - replay window 24h.
  • RFC 7807-flavored error envelope.
  • Webhook timeout 10s; 7 retries (30s → 24h).
  • Signature X-Danum-Signature: t=,v1= replay window 5 min.
  • Auto-disable webhook after 100 consecutive failures.
  • Rotate secret with no downtime: old + new both active for 24h.