HTTP status codes
| Status | Meaning | Developer action |
|---|---|---|
| 200 | Read request succeeded. | Process the response envelope. |
| 201 | Contact creation succeeded. | Store the returned contact id if needed. |
| 202 | Template message was queued. | Track the returned message id. |
| 401 | Missing, invalid, revoked, or expired API key. | Check secret storage and key status. |
| 403 | Missing scope or workspace permission. | Use least-privilege scopes and request only the needed access. |
| 404 | Resource not found in this workspace. | Never assume ids are global across tenants. |
| 422 | Validation or business rule failure. | Fix request fields or respect opt-out state. |
| 429 | Rate limit. | Back off and retry later. |
| 500 | Unexpected server error. | Retry safely and contact support with non-secret request ids. |
API key handling
- Store API keys only in server-side secrets.
- Use one key per integration.
- Grant only required scopes.
- Rotate keys after staff changes or suspected exposure.
- Revoke keys that are no longer needed.
Tenant boundaries
The API key chooses the workspace. Do not send another workspace id and expect cross-workspace access. Build integrations so each customer has their own key and configuration.
Webhook security
- Use HTTPS.
- Verify the HMAC signature before processing.
- Reject old or duplicate deliveries according to your own tolerance.
- Do not log webhook secrets or full sensitive payloads.
What not to document or use
Razorpay provider webhooks, Meta inbound webhooks, Super Admin APIs, internal billing endpoints, debug endpoints, and private support-ticket data are not customer public API surfaces.