Skip to main content
All meaningful, customer-facing changes to the OptimalDial REST API and webhook contract are listed here. The api_version field on webhook payloads changes only when the payload shape itself changes.

​
2026-04-23 — v1 GA

Initial general availability of the public API. New endpoints
  • POST /api/v1/uploads — submit phone-number lists in CSV (multipart) or JSON form.
  • GET /api/v1/uploads, GET /api/v1/uploads/{id} — list and retrieve uploads.
  • DELETE /api/v1/uploads/{id} — cancel an upload that hasn’t started processing.
  • GET /api/v1/uploads/{id}/download/{original|processed|processed-filtered} — short-lived signed download URLs.
  • POST /api/v1/webhooks, GET /api/v1/webhooks, GET /api/v1/webhooks/{id}, PATCH /api/v1/webhooks/{id}, DELETE /api/v1/webhooks/{id} — manage webhook endpoints.
  • GET /api/v1/webhooks/{id}/deliveries — recent delivery attempts for one endpoint.
Authentication
  • od_live_* API keys, scoped to a single organization. Owner-only minting via the in-app developer panel; SHA-256 hashed at rest; auto-revoked when the creating user leaves the org.
Webhooks
  • Three event types: upload.created, upload.completed, upload.failed.
  • HMAC-SHA256 signatures over {timestamp}.{body}, in Stripe-compatible t=…,v1=… format.
  • 5-minute replay window.
  • Up to 6 delivery attempts with backoff (1m, 5m, 30m, 2h, 12h between attempts).
  • Endpoints auto-disabled after 20 consecutive failures.
  • SSRF hardening: HTTPS-only, public IPs only, redirects not followed.
Rate limits
  • 60 requests/minute per API key, 600 requests/minute per organization, on write endpoints.