The Natiq REST API gives you the same access the dashboard has: read and work conversations, manage contacts and audiences, connect channels, run agents and campaigns, and administer your organisation. It speaks JSON over HTTPS.

Base URL

Every path in this reference is relative to:

https://api.cx.na6iq.com/api/v1

So GET /contacts means GET https://api.cx.na6iq.com/api/v1/contacts. Your organisation is taken from your access token, so it never appears in a path.

Authentication

Sign in to get an access token, then send it as a bearer token on every request.

1. Call POST /auth/login with your email and password. Sign-in, registration and the password and invitation routes are the only calls that take no token.

2. Read accessToken from the response.

3. Send Authorization: Bearer <accessToken> with every other request.

cURL

curl -X POST "https://api.cx.na6iq.com/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{ "email": "omar@example.com", "password": "<YOUR_PASSWORD>" }'

Response

{
  "accessToken": "<ACCESS_TOKEN>",
  "tokenType": "Bearer",
  "orgId": 12,
  "userId": 214,
  "email": "omar@example.com",
  "expiresInHours": 24
}

A token is valid for expiresInHours (24 by default). There is no refresh endpoint: when a call answers 401, sign in again. POST /auth/logout ends the session whose token you send, and revokes the token on the server.

Keep tokens out of source code

A token acts as the person who signed in, with all of their permissions. Store it in an environment variable or a secrets manager, never in a repository, a URL or a log.

Permissions

A token can do only what its user’s roles allow. Each endpoint in this reference names the permission key it needs, such as contacts:read or liveagent.tickets:assign. Calling an endpoint without it answers 403 with the code ACCESS_DENIED. See Errors.

Conventions

• JSON in, JSON out. Send Content-Type: application/json. Field names are camelCase.
• Timestamps are ISO 8601 instants in UTC, such as 2026-11-06T09:41:12Z.
• IDs are integers. They are unique within a kind of object, not across kinds: a contact and a segment can both be 12.
• Empty values. A field documented as nullable comes back as null when it has no value. A few optional fields are left out of a response entirely when they do not apply.
• Serialised JSON strings. Some fields carry a JSON document inside a string, such as configJson on a channel, expressionsJson on a segment and flowJson when publishing an agent. In responses you parse them yourself; in a request, send the string. The one exception is contentJson when you send a message, which takes a real JSON value.
• Query arrays repeat the key (?status=OPEN&status=PENDING), and empty values are dropped.
• Lists are either paginated or returned as a plain array. Each endpoint says which; see Pagination.
• Errors share one envelope with a stable code to branch on. See Errors.

Resources

ConversationsList tickets, assign or claim them, change status, manage labels.MessagesRead a timeline, send replies, leave private notes.ContactsCreate, find, update and merge the people you talk to.Contact listsStatic audiences you fill by hand.SegmentsAudiences defined by rules, with a live preview.ChannelsConnect WhatsApp, Web Chat and more, and choose who answers.External botsLet your own chatbot answer channel lines.AgentsCreate AI agents, save drafts and publish.TriggersStart a flow from a webhook URL or a schedule.CampaignsBroadcast a WhatsApp template and follow delivery.WhatsApp templatesCreate and manage Meta-reviewed templates.OrganisationProfile, brand, users, invitations and roles.