Jelliu API documentation

curl -X PATCH https://api.jelliu.co/api/integrations/c71e4a09-2f8b-4d63-8e15-b90d3a6c2f71 \
     -H "Authorization: Bearer <token>" \
     -H "Content-Type: application/json" \
     -d '{
  "status": "paused"
}'

{
  "data": {
    "id": "c71e4a09-2f8b-4d63-8e15-b90d3a6c2f71",
    "tenant_id": "8a41c7e2-3b5d-4f09-a6e1-7d2c9b0f4e58",
    "provider": "webhook",
    "label": "Formulario web",
    "auth_method": "credentials",
    "status": "paused",
    "credentials": "***",
    "contact_count": 412,
    "last_synced_at": "2026-09-14T22:03:51.000Z",
    "last_error": null,
    "field_mapping": {
      "correo": "email",
      "nombre": "name",
      "telefono": "phoneNumber"
    },
    "campaign_id": "7a8b9c0d-1e2f-4a3b-8c4d-5e6f7a8b9c0d",
    "oauth_expires_at": null,
    "oauth_scopes": null,
    "inbound_webhook_uuid": "e04f7b3a-91c2-4d58-a3e6-1f8b2c9d7a05",
    "created_at": "2026-08-19T16:45:02.000Z",
    "updated_at": "2026-09-15T13:40:18.000Z",
    "deleted_at": null,
    "webhook_secret": null,
    "external_account_id": null,
    "sync_cursor": null,
    "ticketing_config": {},
    "oauth_metadata": {},
    "oauth_access_token": null,
    "oauth_refresh_token": null,
    "discovered_schema": {
      "entityType": "contact",
      "fields": [
        {
          "confidence": 0.9,
          "name": "telefono",
          "sample": "+573001234567",
          "type": "phone"
        }
      ],
      "suggestedMapping": {
        "telefono": "phoneNumber"
      }
    }
  }
}

Changes only the fields present in the body. credentials replaces the stored credentials wholesale (no merge) and does not re-run the connection test — call POST /api/integrations/{integrationId}/test afterwards. fieldMapping replaces the whole mapping. campaignId: null unlinks the campaign. status accepts only active and paused; error and pending_auth are set by Jelliu. An empty body is accepted and only bumps updated_at.

Side effects. Encrypts new credentials; clears the integration caches; writes an audit entry (action update, resource integration, credentials redacted). Pausing an OAuth integration also takes it out of the background token-refresh scan.

Idempotency. Safe to retry: sending the same body again yields the same stored values.

Webhook events. audit.log_recorded for webhooks subscribed to it. See Webhooks.

Access

Required scope: full. Humans need the admin or owner role.
Rate limit: General API (120–600 requests/min per workspace by plan) plus the configuration-mutation limiter — 10 requests/min per workspace. See Rate limits.
Plan: Available on every plan.

Changes only the fields present in the body. `credentials` replaces the stored credentials wholesale (no merge) and does **not** re-run the connection test — call `POST /api/integrations/{integrationId}/test` afterwards. `fieldMapping` replaces the whole mapping. `campaignId: null` unlinks the campaign. `status` accepts only `active` and `paused`; `error` and `pending_auth` are set by Jelliu. An empty body is accepted and only bumps `updated_at`. **Side effects.** Encrypts new credentials; clears the integration caches; writes an audit entry (action `update`, resource `integration`, credentials redacted). Pausing an OAuth integration also takes it out of the background token-refresh scan. **Idempotency.** Safe to retry: sending the same body again yields the same stored values. **Webhook events.** `audit.log_recorded` for webhooks subscribed to it. See [Webhooks](/webhooks). **Access** - **Required scope:** `full`. Humans need the `admin` or `owner` role. - **Rate limit:** General API (120–600 requests/min per workspace by plan) plus the configuration-mutation limiter — 10 requests/min per workspace. See [Rate limits](/rate-limits). - **Plan:** Available on every plan.

Authentication

AuthorizationBearer

Workspace API key: jl_ followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (Settings → API Keys) and sent as Authorization: Bearer jl_.... The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys.

Scope	GET / HEAD	POST / PUT / PATCH / DELETE	Admin-only routes
`read`	Yes	No	No
`write`	Yes	Yes	No
`full`	Yes	Yes	Yes

Operations restricted to admins or owners reject keys without the full scope with 403, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See Authentication.

Workspace API key: `jl_` followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (**Settings → API Keys**) and sent as `Authorization: Bearer jl_...`. The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys. | Scope | GET / HEAD | POST / PUT / PATCH / DELETE | Admin-only routes | | --- | --- | --- | --- | | `read` | Yes | No | No | | `write` | Yes | Yes | No | | `full` | Yes | Yes | Yes | Operations restricted to admins or owners reject keys without the `full` scope with `403`, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See [Authentication](/authentication).

Path parameters

integrationIdstringRequiredformat: "uuid"

Integration to update. A value that is not a UUID is rejected with 400.

Request

This endpoint expects an object.

labelstringOptional<=200 characters

New display name.

credentialsmap from strings to anyOptional

Replacement credentials. Encrypted at rest and never returned.

fieldMappingmap from strings to stringsOptional

Replacement mapping, source field → Jelliu contact field. Salesforce keys must be valid field identifiers.

campaignIdstring or nullOptionalformat: "uuid"

Campaign that inbound contacts go to; null unlinks it.

statusenumOptional

paused — stop background token refresh for the integration and mark it inactive (features that require active, such as the Kommo agent CRM tools, refuse to run). active — resume it.

Allowed values:

Response

The updated integration.

dataobject

The full integration record returned by retrieve, create and update: every Integration field plus the columns below. credentials is still masked; OAuth tokens appear only as encrypted ciphertext.

Errors

400

Bad Request Error

401

Unauthorized Error

403

Forbidden Error

404

Not Found Error

429

Too Many Requests Error

Idempotency. Safe to retry: sending the same body again yields the same stored values.

Webhook events. audit.log_recorded for webhooks subscribed to it. See Webhooks.

Access

Required scope: full. Humans need the admin or owner role.
Rate limit: General API (120–600 requests/min per workspace by plan) plus the configuration-mutation limiter — 10 requests/min per workspace. See Rate limits.
Plan: Available on every plan.