Connect your CRM or any system to BotLink — read leads, send messages, and receive real-time webhooks.
Create an API key in Dashboard → Developers. Send it on every request:
curl https://bot-link.com/api/v1/bots \
-H "X-Api-Key: blk_live_..."Keys are shown once at creation and stored hashed. read keys can only GET; read_write keys can also PATCH leads and send messages. Rate limit: 600 requests/min per key (headers: RateLimit-*).
| Endpoint | Description |
|---|---|
| GET /api/v1/bots | Your bots (id, name, connection status) |
| GET /api/v1/bots/:botId/leads | Leads. Filters: ?status=hot, ?since=ISO-date, ?limit=&offset= |
| GET /api/v1/bots/:botId/leads/:phone | One lead incl. AI summary, wants, next step |
| PATCH /api/v1/bots/:botId/leads/:phone | Update status / name / email (read_write) |
| GET /api/v1/bots/:botId/leads/:phone/messages | Conversation transcript (chronological) |
| POST /api/v1/bots/:botId/messages | Send a WhatsApp message via the bot (read_write) |
| GET /api/v1/bots/:botId/bookings | Bookings. Filters: ?date=YYYY-MM-DD, ?status= |
| GET /api/v1/bots/:botId/orders | Orders |
| GET /api/v1/bots/:botId/listings | Property / product listings |
curl -X POST https://bot-link.com/api/v1/bots/BOT_ID/messages \
-H "X-Api-Key: blk_live_..." -H "Content-Type: application/json" \
-d '{ "phone": "972501234567", "text": "היי! מדברים מהמשרד 👋", "pause": true }'pause (default true) pauses the bot for that lead — human-takeover semantics, same as replying from the dashboard. Pass false for automation flows so the bot keeps answering. Returns 409 bot_offline when WhatsApp isn't connected.
{ "error": { "code": "invalid_key", "message": "Unknown or revoked API key." } }Register endpoints per bot in Dashboard → your bot → Settings → Webhooks. BotLink POSTs a signed JSON event the moment it happens. Events:
lead.created lead.updated lead.hot message.received message.sent handoff.requested booking.created booking.updated order.created listing.inquiry bot.disconnected
lead.updated fires whenever a lead's core fields change — the bot captures/updates the name, the AI refreshes status/summary/email, the owner edits the lead in the dashboard, or an API PATCH lands. Its data includes phone, name, email, status, summary and a source of bot, ai, dashboard or api — if you update leads via the API, skip events with source: "api" to avoid processing your own writes.
{
"id": "evt_9f2c…",
"type": "lead.hot",
"created": 1751463823,
"bot_id": "…",
"data": { "phone": "972501234567", "name": "Dana", "summary": "Wants a demo…" }
}Every delivery carries X-BotLink-Signature: t=<unix>,v1=<hmac>, signed with your endpoint's secret (shown once when you create the endpoint):
// Node.js
import { createHmac } from 'crypto';
function verify(secret, rawBody, header) {
const m = /t=(\d+),v1=([a-f0-9]{64})/.exec(header || '');
if (!m) return false;
if (Math.abs(Date.now()/1000 - Number(m[1])) > 300) return false; // replay window
const expect = createHmac('sha256', secret).update(`${m[1]}.${rawBody}`).digest('hex');
return m[2] === expect;
}Delivery: 10s timeout, retries after 1m / 5m / 30m on failure, endpoint auto-disabled after 10 consecutive failures (re-enable it from the dashboard). Respond 2xx quickly; process async.
Questions? [email protected] · ← Dashboard