Public API reference

The public HTTP API for server-side and SDK integrations — authentication headers and endpoints.

The public API is served from https://api.engageapp.xyz. There are two authentication schemes depending on the endpoint.

Authentication

  • Secret key — server-side endpoints. Send X-API-Key: df_….
  • Publishable key — client SDK (in-app) endpoints. Send X-Publishable-Key: pk_….

Server-side endpoints (secret key)

  • POST /api/v1/public/contacts — batch upsert contacts and register devices.
  • POST /api/v1/public/events — batch ingest behavioral events.
  • POST /api/v1/public/enroll — enroll a contact into a campaign.

In-app SDK endpoints (publishable key)

These are called by the client SDKs; you normally don't call them directly.

  • POST /api/v1/public/inapp/identify — resolve/create the contact for an external_id.
  • GET /api/v1/public/inapp/messages?external_id=… — fetch the next pending takeover.
  • POST /api/v1/public/inapp/messages/:id/events — report shown / clicked / dismissed.

When identity verification is enabled for your workspace, the in-app endpoints additionally require a valid X-Identity-Hash header. See the In-App Takeover setup guide.

Related

Server-side integration guide

Connect EngageApp to your backend with a secret API key — sync contacts, track events, and enroll contacts into campaigns.

API keys

Create and manage secret and publishable API keys to authenticate server-side calls and client SDKs.

Events

Send behavioral events about your contacts to trigger campaigns, gate waits, and power segments.

Contacts

How EngageApp models your end-users as contacts, the fields they carry, and the ways to add them.

Web SDK reference

API reference for @engageapp/inapp-web — init, identify, onAppForeground, setHandlers, and dismiss.