Documentation

Orbit API

A REST API for pushing leads into Orbit and driving the Beam chatbot programmatically. All requests and responses are JSON over HTTPS. See webhooks for events Orbit pushes out to you, and security for data handling.

Base URL

https://orbitdao.io

Self-hosted or white-label workspaces use their own domain; every path below stays the same.

Authentication

Create API keys in the app under Settings → Developers / API. The key is shown once at creation; Orbit stores only a SHA-256 hash and a short prefix for identification. Keys are scoped to a single workspace and can be revoked at any time. Send the key as a bearer token:

Authorization: Bearer orb_xxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/json

The lead endpoint also accepts api_key as a body field so it can be used from plain HTML form posts.

Core objects (v1)

Full read/write access to contacts, deals, tasks and notes. Every response is wrapped in data, list responses add pagination (limit 1–100, offset, total, has_more), and every list supports updated_since (ISO-8601) for incremental sync plus order=asc|desc. Errors return { "error": { "code", "message" } }.

GET/api/public/v1/me

Verifies a key and returns the workspace it belongs to. Use it as a connection test.

curl https://orbitdao.io/api/public/v1/me -H "Authorization: Bearer $ORBIT_API_KEY"

{ "data": { "workspace": { "id": "...", "name": "Orbit", "slug": "orbit" },
            "api_key": { "id": "...", "name": "Zapier" }, "api_version": "v1" } }
GET/api/public/v1/contacts

Lists contacts. Filters: status, owner_id, tag, hot_lead, q (name, email or company), updated_since.

curl "https://orbitdao.io/api/public/v1/contacts?status=in_conversation&limit=50" \
  -H "Authorization: Bearer $ORBIT_API_KEY"
POST/api/public/v1/contacts

Creates a contact. name is required. If email matches an existing contact the record is updated instead and deduplicated: true is returned — send "deduplicate": false to force a new record.

Writable fields: name, email, phone, company, title, country, city, website, linkedin_url, industry, notes, status, lead_source, source, deal_value, deal_probability, expected_close_date, deal_type, tags, contact_type, hot_lead, priority.

GET · PATCH · DELETE/api/public/v1/contacts/{id}

Fetch, update or delete a single contact. PATCH accepts any writable field above; changes emit the matching contact.* webhook events.

curl -X PATCH https://orbitdao.io/api/public/v1/contacts/$ID \
  -H "Authorization: Bearer $ORBIT_API_KEY" -H "Content-Type: application/json" \
  -d '{ "status": "negotiation", "deal_value": 24000 }'
GET · POST/api/public/v1/contacts/{id}/notes

Reads the note timeline for a contact, or appends one. POST body: content (required), note_type.

GET/api/public/v1/deals

The pipeline view. Orbit tracks the opportunity on the contact record, so a deal id is the contact id. Filters: stage, open=true (excludes won and lost), min_value, updated_since. Responses include a summary.total_value.

GET · PATCH/api/public/v1/deals/{id}

Reads or updates a single opportunity using deal vocabulary: stage, value, probability, expected_close_date, deal_type, hot_lead.

GET/api/public/v1/pipeline-stages

The workspace's configured stages, in order — use it to build a board without hard-coding stage keys.

GET · POST/api/public/v1/tasks

Lists or creates tasks. Filters: status (todo, in_progress, blocked, done), priority (low, medium, high, urgent), assignee_id, contact_id, due_before, q.

Writable fields: title (required), description, status, priority, due_date, assignee_id, contact_id, goal_id, tags, estimated_minutes, logged_minutes, priority_star, project_key.

GET · PATCH · DELETE/api/public/v1/tasks/{id}

Single task read, update and delete. Setting status to done emits task.completed.

GET/api/public/v1/events

The machine-readable catalogue of every event Orbit can emit, grouped by object — the same list documented on the webhooks page.

Ingest and Beam endpoints

POST/api/public/leads

Creates a contact in the workspace that owns the API key, then fires the lead.received and contact.created webhook events.

Accepts application/json or application/x-www-form-urlencoded (for direct HTML form posts). CORS is open, so it can be called from the browser.

Body: name (required), email, phone, company, title, country, linkedin_url, lead_source, notes, deal_value, tags (array or comma-separated string, max 20).

curl -X POST https://orbitdao.io/api/public/leads \
  -H "Authorization: Bearer $ORBIT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Ada Lovelace",
    "email": "ada@example.com",
    "company": "Analytical Engines",
    "lead_source": "Website form",
    "deal_value": 12000,
    "tags": ["inbound", "enterprise"]
  }'

# 201 Created
{ "ok": true, "contact_id": "0f0b1f2c-..." }
POST/api/public/leads/{tenantSlug}/{sourceKey}

Keyless variant for embedded forms. The source key identifies a lead source configured under Lead Sync, so submissions are attributed automatically. Same body fields as above; intended for public forms where an API key cannot be kept secret.

POST/api/public/beam/v1/message

Sends a message to the Beam AI chatbot and returns its reply. Bearer-authenticated with a Beam key.

Body: message (required, ≤4000 chars), conversationId (UUID, optional — omit to start a new conversation), visitor (name, email, phone).

curl -X POST https://orbitdao.io/api/public/beam/v1/message \
  -H "Authorization: Bearer $BEAM_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "message": "Do you integrate with Gmail?" }'
GET/api/public/beam/v1/conversations

Lists Beam conversations for the workspace, newest first. Bearer-authenticated with a Beam key.

GET/api/public/beam/v1/leads

Lists leads captured by Beam. Bearer-authenticated with a Beam key.

GET/beam.js

The Beam embed script. Drop it into any site to render the chat widget; no key is exposed to the browser beyond the public workspace identifier.

<script src="https://orbitdao.io/beam.js" data-orbit-tenant="your-workspace" async></script>

Errors

Errors return a JSON body of the shape { "error": "message" }.

400Malformed body, or a required field such as name is missing.
401Missing or invalid API key.
403Key is valid but not permitted for this workspace or resource.
404Unknown workspace slug or lead source key.
500Unexpected server error. Safe to retry with backoff.

Rate limits and CORS

Public ingest endpoints send permissive CORS headers and answer OPTIONS preflight requests. Fair-use limits apply per workspace; if you expect sustained volume above a few requests per second, contact us and we will raise the ceiling for your key.

Versioning

Beam endpoints are versioned in the path (/v1/). Additive changes — new optional fields, new response properties — ship without a version bump. Breaking changes ship as a new version and the previous one stays available. Deprecations are announced by email to workspace admins before removal.

Need something that isn't here?

Contacts, deals, tasks, notes, pipeline stages and the event catalogue are all live. Invoices, proposals, events and quests are next. Tell us which objects you need and we will prioritise accordingly — get in touch.