Technical documentation

REST API — idempotent, official SDKs, OpenAPI 3.1

Bearer authentication, automatic retries in the SDKs, HMAC SHA-256 signed webhooks and versioned schema. Built for teams that need to ship this week — not next quarter.

Authentication

Bearer token + granular scopes

Every API call requires a token in the header Authorization: Bearer …. Issue separate tokens per environment (prod, staging, sandbox), per scope (messages:send,templates:manage,analytics:read), with a configurable TTL. Key rotation with a 24-hour overlap, no downtime.

Tokens per environment and scope
Rotation with 24h overlap, no downtime
Isolated rate-limit per token
Audit log of every call in the dashboard

curl https://api.ccx.co/v1/messages \
  -H "Authorization: Bearer $CCX_API_KEY" \
  -H "Content-Type: application/json"

Send message

`POST` /v1/messages

Sends a single message via WhatsApp, SMS or email. Use template for HSM messages (required to open a conversation) or text / media / interactive within a 24h window. Always idempotent: send the same idempotency_key and CCX guarantees single delivery.

Idempotency by key (7-day window)
Automatic cross-channel fallback
Priority: low / default / high / critical
Scheduled send with timezone
Server-side template validation

curl https://api.ccx.co/v1/messages \
  -H "Authorization: Bearer $CCX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+5511999990000",
    "channel": "whatsapp",
    "template": {
      "name": "order_confirmation",
      "language": "pt_BR",
      "variables": {
        "1": "Maria",
        "2": "#A8492",
        "3": "R$ 349,90"
      }
    },
    "idempotency_key": "ord_A8492"
  }'

Bulk broadcast

`POST` /v1/broadcasts

Fires a broadcast to a pre-computed segment. Fine-grained rate control, per-tenant priority, scheduling and per-recipient retries. Live status available via streaming at GET /v1/broadcasts/:id/events (SSE).

Configurable per-minute rate-limit
Pause/resume without losing context
Smart batching: 500 recipients per job, idempotent
Dry-run to preview cost upfront

curl https://api.ccx.co/v1/broadcasts \
  -H "Authorization: Bearer $CCX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Black Friday — Batch 1",
    "template": "black_friday_2026",
    "language": "pt_BR",
    "segment_id": "seg_ZZ11",
    "rate_limit_per_minute": 6000,
    "priority": "high",
    "schedule_at": "2026-11-28T09:00:00-03:00"
  }'

Webhooks

Events signed with HMAC SHA-256

Each event leaves your tenant with an HMAC signature you can verify on the header CCX-Signature. Automatic redelivery with exponential backoff up to 24h, ordering guaranteed by message_id, and manual replay from the dashboard for any window in the last 30 days.

message.queuedmessage.sentmessage.deliveredmessage.readmessage.failedmessage.replybroadcast.progressbroadcast.completedtemplate.approvedtemplate.rejected

# Sample payload delivered to your HTTPS endpoint:
POST /webhooks/ccx HTTP/1.1
CCX-Signature: t=1745347200,v1=a6f7…
Content-Type: application/json

{
  "event": "message.delivered",
  "message_id": "msg_0xK91A",
  "conversation_id": "cnv_44aa",
  "to": "+5511999990000",
  "template": "order_confirmation",
  "delivered_at": "2026-04-22T14:20:12Z",
  "billable": { "category": "utility", "price": 0.16, "currency": "BRL" }
}

Limits & SLAs

Transparent about what the API can deliver

Rate-limits

• Send API: 6,000 req/min per token (Pro) · 50,000 req/min (Enterprise)
• Burst up to 1,200 req/s for short windows
• X-RateLimit-Remaining / X-RateLimit-Reset headers on every response
• Soft throttling: we never return 429 without a prior warning

Idempotency

• idempotency_key required on POST /messages and /broadcasts
• 7-day window — returns the cached response
• Key UUID v4, ULID or custom (max 128 chars)
• Replays are not counted against volume

Latencies and SLA

• p50 send: 38ms · p99 ingest: <200ms
• Delivery to Meta Cloud API: p99 < 500ms
• Outbound webhooks: p99 < 2s after event
• Monthly uptime: 99.9% (Business) · 99.95% (Enterprise)

Official SDKs

Same API, multiple languages

SDKs generated from the same OpenAPI 3.1. Exponential retries, pluggable telemetry, strong typing and contract tests in CI on every release.

Node.js · TypeScript

@ccxcompany/sdk

npm i @ccxcompany/sdk

Python · Pydantic v2

ccx-sdk

pip install ccx-sdk

PHP 8.2+ · PSR-18

ccxcompany/sdk-php

composer require ccxcompany/sdk

Go 1.22+ · context-aware

github.com/ccxcompany/go

go get github.com/ccxcompany/go

Ruby 3.3+ · Sorbet

ccxcompany/sdk-ruby

gem install ccxcompany-sdk

Java 17+ · Maven Central

com.ccxcompany:sdk

mvn install com.ccxcompany:sdk

Ready to write your first curl?

Create a sandbox account in 2 minutes. Free tokens, no card, no lock-in.

Activate sandbox View pricing