OverviewHow It WorksFeaturesPricingDocumentationUse CasesIntegrationsSMSEmailGet Started
Technical documentation

Idempotent REST API, official SDKs, OpenAPI 3.1

Bearer authentication, automatic retries in SDKs, HMAC SHA-256 signed webhooks and versioned schema. Built for those who need to go to production this week — not next quarter.

Authentication

Bearer token + fine-grained scopes

All API calls require a token in the header Authorization: Bearer …. You create separate tokens per environment (prod, staging, sandbox), per scope (messages:send,templates:manage,analytics:read), and with configurable TTL. Key rotation without downtime via 24-hour overlap.

  • Tokens per environment and scope
  • Rotation with 24h overlap without downtime
  • Rate-limit isolated per token
  • Audit log of every call in the dashboard
curl https://api.ccx.co/v1/messages \
  -H "Authorization: Bearer $CCX_API_KEY" \
  -H "Content-Type: application/json"
Send message

POST /v1/messages

Sends an individual message via WhatsApp, SMS or email. Use template for HSM messages (required to start conversation) or text / media / interactive within a 24h window. Always idempotent: send the same idempotency_key and CCX guarantees single delivery.

  • Idempotency by key (7-day window)
  • Automatic cross-channel fallback
  • Priority: low / default / high / critical
  • Scheduled send with timezone
  • Server-side template validation
curl https://api.ccx.co/v1/messages \
  -H "Authorization: Bearer $CCX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "to": "+5511999990000",
    "channel": "whatsapp",
    "template": {
      "name": "order_confirmation",
      "language": "pt_BR",
      "variables": {
        "1": "Maria",
        "2": "#A8492",
        "3": "R$ 349,90"
      }
    },
    "idempotency_key": "ord_A8492"
  }'
Mass broadcast

POST /v1/broadcasts

Fires a broadcast to a pre-calculated segment. Fine flow control, priority per tenant, scheduling and retries per recipient. Status available in streaming via GET /v1/broadcasts/:id/events (SSE).

  • Rate-limit per minute configurable
  • Pause/resume without losing context
  • Smart batching: 500 recipients per job, idempotent
  • Dry-run to validate cost before
curl https://api.ccx.co/v1/broadcasts \
  -H "Authorization: Bearer $CCX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Black Friday — Batch 1",
    "template": "black_friday_2026",
    "language": "pt_BR",
    "segment_id": "seg_ZZ11",
    "rate_limit_per_minute": 6000,
    "priority": "high",
    "schedule_at": "2026-11-28T09:00:00-03:00"
  }'
Webhooks

Events signed by HMAC SHA-256

Each event leaves your tenant with verifiable HMAC signature in header CCX-Signature. Automatic redelivery with exponential backoff up to 24h, guaranteed ordering by message_id, and manual replay via dashboard for any window from the last 30 days.

message.queuedmessage.sentmessage.deliveredmessage.readmessage.failedmessage.replybroadcast.progressbroadcast.completedtemplate.approvedtemplate.rejected
# Example of payload received at your HTTPS endpoint:
POST /webhooks/ccx HTTP/1.1
CCX-Signature: t=1745347200,v1=a6f7…
Content-Type: application/json

{
  "event": "message.delivered",
  "message_id": "msg_0xK91A",
  "conversation_id": "cnv_44aa",
  "to": "+5511999990000",
  "template": "order_confirmation",
  "delivered_at": "2026-04-22T14:20:12Z",
  "billable": { "category": "utility", "price": 0.10, "currency": "BRL" }
}
Limits & SLAs

Transparent about what the API can deliver

Rate-limits

  • • Send API: 6,000 req/min per token (Pro) · 50,000 req/min (Enterprise)
  • • Burst up to 1,200 req/s in short windows
  • • Headers X-RateLimit-Remaining / X-RateLimit-Reset on all responses
  • • Soft throttling: never return 429 without warning first

Idempotency

  • • idempotency_key mandatory in POST /messages and /broadcasts
  • • 7-day window — returns same cached response
  • • Key UUID v4, ULID or custom (max 128 chars)
  • • Replays not counted in volume

Latencies and SLA

  • • p50 send: 38ms · p99 ingest: <200ms
  • • Delivery to Meta Cloud API: p99 < 500ms
  • • Outbound webhooks: p99 < 2s after event
  • • Monthly uptime: 99.9% (Business) · 99.95% (Enterprise)
Official SDKs

Same API, multiple languages

SDKs generated from the same OpenAPI 3.1. Exponential retries, pluggable telemetry, strong typing and contract tests in CI for each release.

Node.js · TypeScript

@ccxcompany/sdk

npm i @ccxcompany/sdk

Python · Pydantic v2

ccx-sdk

pip install ccx-sdk

PHP 8.2+ · PSR-18

ccxcompany/sdk-php

composer require ccxcompany/sdk

Go 1.22+ · context-aware

github.com/ccxcompany/go

go get github.com/ccxcompany/go

Ruby 3.3+ · Sorbet

ccxcompany/sdk-ruby

gem install ccxcompany-sdk

Java 17+ · Maven Central

com.ccxcompany:sdk

mvn install com.ccxcompany:sdk

Ready to write your first curl?

Create a sandbox account in 2 minutes. Free tokens, no card, no lock-in.

Activate sandboxView pricing