Skip to content

Conventions

What URL
REST API https://api.nexacloser.com/v1
Inbound webhooks https://hook.nexacloser.com/<slug>
MCP server https://api.nexacloser.com/mcp
OAuth for MCP clients https://api.nexacloser.com/oauth/… (discovered automatically)

Only HTTPS. Every REST path in these docs is relative to https://api.nexacloser.com/v1, so POST /contacts means POST https://api.nexacloser.com/v1/contacts.

  • Send Content-Type: application/json and a JSON object body. Inbound webhooks also accept form fields.
  • Authenticate with Authorization: Bearer <key>. See API keys.
  • Call the API from your server. Keys are secrets, so the API does not answer browser requests from other sites (the Swagger UI on this site is the one exception).

Every object has a short id with a type prefix, for example:

Prefix Object
org_ Workspace (organization)
cnt_ Contact
dl_ Deal
wbn_ Webinar
wbr_ Webinar registration
whk_ Inbound webhook
whx_ Inbound webhook execution

Treat ids as opaque strings. Do not parse them.

Send phone numbers in E.164 form, for example +14155550101 or +972501234567. A number without a country code is read with your workspace’s country. NexaCloser stores the normalized number, and contacts are matched on it.

Times are ISO 8601 strings in UTC, for example 2026-11-05T14:03:11Z. A time you send with an offset (+02:00) is accepted.

  • Success responses are JSON. The status code says what happened: 200 done, 201 created.
  • Errors are JSON with an error field. Newer endpoints (contacts, webinar registrations) use stable lowercase codes such as invalid_json or validation_failed; a few older endpoints send a short English message such as Unauthorized. See Errors.
  • Rate limit headers come with every authenticated response. See Rate limits.

The API is versioned in the path (/v1). Fields may be added to responses and new optional request fields may appear at any time, so ignore fields you do not know. Breaking changes go to a new version and are announced in the changelog.