Nudgenie API & Webhooks
The API behind the dashboard.
Nudgenie's dashboard isn't a separate thing from its API — it's built on it. Contacts, segments, templates, Flows, campaigns, inbox, usage and spend, Meta Business Agent — every one of those screens is a client of the same REST API underneath.
Self-serve Private App tokens for contact sync, campaigns, and ad-hoc sends. A signed webhook for real-time contact sync.
Talk to Our Team →The platform
Nothing locked behind a UI-only feature
Because the dashboard is itself an API client, every core capability below is something a deep integration can reach too — not a marketing summary of what the product does, but what the API underneath it already does.
Contacts & Segments
Create, update, list, and delete contacts. Build a typed attribute catalog and live segments, with a preview count before you send.
Campaigns
Create, dispatch, resend, and read recipient-level status for every campaign — the same lifecycle the dashboard drives.
Templates & Flows
Manage WhatsApp message templates and native Flows end to end — create, update, sync against Meta, publish, deprecate, clone, and check live health.
Inbox & Conversations
Read conversations and messages, send a free-form reply inside the service window, mark read/unread, and hand a conversation back to Meta’s AI Business Agent.
Users & Access
Manage teammates and roles, and read usage and spend broken down by Meta’s own message categories.
Meta Business Agent
Check AI Business Agent eligibility, enable or disable it per number, and manage its knowledge base — files, FAQs, business info, and websites.
Start here: self-serve integration
A Private App token, scoped to exactly what your integration needs
For the most common integration pattern — keeping contacts in sync and triggering sends from your own system — create a Private App in your workspace and get a token scoped to exactly the actions below. Building something deeper into campaigns, templates, Flows, or the inbox? Talk to our team — see the FAQ below.
/api/v1/contacts/syncscope: contacts:writeSync contacts
Create or update a contact from your own system — CRM, ecommerce platform, signup form — without anyone opening the Nudgenie dashboard.
/api/v1/private-apps/campaignsscope: campaigns:writeCreate a campaign
Trigger a campaign from your own code — same underlying campaign logic the dashboard uses.
/api/v1/private-apps/campaigns/{campaign}/dispatchscope: campaigns:writeDispatch a campaign
Send a campaign you created, on your own schedule — a cron job, a queue worker, or an event in your system.
/api/v1/private-apps/messages/ad-hocscope: messages:writeSend an ad-hoc message
Send a single approved-template message to one contact directly, without wrapping it in a campaign.
The webhook
contact.upserted — signed, retried, never silently dropped
When a contact is created or updated — through the API, a CSV import, or the dashboard — Nudgenie posts a signed event to your webhook URL. Every request carries an X-Nudgenie-Signature header, an HMAC-SHA256 signature of the exact body, computed server-side with a secret unique to your Private App. The signed body also carries its own delivery_id and dispatched_at, so a receiver can detect a replayed delivery.
If your endpoint is down or errors out, Nudgenie retries automatically — up to 5 attempts, backing off over 30 seconds, 2 minutes, 10 minutes, 30 minutes, and 1 hour. Every attempt is recorded against the delivery; it's only marked failed once all 5 are exhausted, never dropped without a trace.
How it works
From a first conversation to a live integration
Tell us what you're building
A CRM sync, an ecommerce trigger, a custom reporting dashboard, a full replacement front end — the right access path depends on the shape of the integration.
Get scoped credentials
Contact sync, campaign create/dispatch, and ad-hoc sends are self-serve today via a Private App token. Need deeper access to what the dashboard itself runs on? Talk to our team about your integration.
Call the API
Every request needs Authorization: Bearer <token> and an X-Tenant-Subdomain header identifying your workspace.
Subscribe to events
Add a webhook URL to get contact.upserted delivered in real time — HMAC-signed, retried automatically if your endpoint is briefly down.
Common Questions
Is the API the same one the Nudgenie dashboard uses, or a limited public subset?
It's the same API. Every dashboard screen — contacts, segments, campaigns, templates, Flows, inbox, usage and spend, Meta Business Agent — is a client of this REST API. Nothing in the dashboard is UI-only functionality unavailable to a direct integration.
How do I get access to build a deep integration?
A purpose-scoped Private App token is self-serve today, and covers the most common integration pattern — triggering sends and keeping contacts current from an external system, whether that's a CRM, ecommerce platform, or internal tool. The fuller surface below (reading campaign history, managing templates and Flows, driving the inbox) is what our own dashboard runs on; broader machine-token access to it is on our roadmap, so talk to our team about what your integration needs in the meantime.
How do I authenticate a Private App integration?
Create a Private App in your Nudgenie workspace, choose the scopes it needs (contacts:write, campaigns:write, messages:write), and you're given a bearer token once at creation — it's never shown again, so store it securely. Send it as a standard Authorization: Bearer header, along with your workspace's X-Tenant-Subdomain header, on every request. A token only works for the scopes it was granted.
What webhook events are available?
One today: contact.upserted, which fires the moment a contact is created or updated through any path — the API, a CSV import, or the dashboard. It's scoped to the same contacts:write permission as the sync endpoint, so a token can't subscribe to contact data it isn't already allowed to write.
How is a webhook delivery secured?
Every delivery carries an X-Nudgenie-Signature header — an HMAC-SHA256 signature of the exact request body, computed server-side with a secret unique to your Private App. The signed body also carries its own delivery_id and a dispatched_at timestamp, so a receiver can detect a replayed request.
What happens if my server is down when a webhook fires?
Nudgenie retries automatically — up to 5 attempts, backing off over 30 seconds, 2 minutes, 10 minutes, 30 minutes, and finally 1 hour. Every attempt is recorded; a delivery is only marked failed once all 5 attempts are exhausted, and it's never silently dropped.
Is there a rate limit?
Yes — 30 requests per 60 seconds by default, applied per tenant and IP across the Private App integration endpoints (contact sync, campaign create/dispatch, and ad-hoc sends), so one integration's traffic never affects another business sharing the platform.
Is API access gated by plan tier?
No — access isn't a paid add-on or a higher-tier feature. What you can reach today is gated by credential type: a Private App token (Admin-created) covers contact sync, campaign create/dispatch, and ad-hoc sends. The fuller surface below is what our own dashboard runs on; broader machine-token coverage of it is on our roadmap — talk to our team about what your integration needs.
Your integration shouldn't hit a wall the dashboard doesn't.
Nudgenie — the same API that runs our own product, available for yours.
Talk to Our Team →