Authentication
The Omnix API uses API key authentication. Every request must include a valid API key issued by an Omnix workspace administrator.
Getting Your API Key
- Log in to your Omnix workspace as an admin.
- Navigate to Admin → API Keys.
- Click Generate API Key, give it a descriptive name (e.g.,
my-crm-integration), and copy the key immediately — it will not be shown again.
API keys are scoped to your subscription. All calls made with a key automatically operate within the subscription that issued it.
Sending the API Key
Include the key as an HTTP header on every request:
POST /api/rpc HTTP/1.1
Host: your-omnix-instance.com
Content-Type: application/json
x-api-key: YOUR_API_KEYFull cURL example
curl -X POST "https://your-omnix-instance.com/api/rpc" \
-H "Content-Type: application/json" \
-H "x-api-key: YOUR_API_KEY" \
-d '{
"method": "OmnixGatewayRpc.ping",
"params": {}
}'Successful response:
{
"success": true,
"message": "Pong!",
"subscriptionId": "64a1b2c3d4e5f6a7b8c9d0e1",
"userId": "64a1b2c3d4e5f6a7b8c9d0e2"
}Subscription Scoping
Every API key belongs to exactly one subscription — the organizational unit in Omnix that contains contacts, channels, campaigns, and conversations.
- The
subscriptionIdis returned in every response and in thepingendpoint. - All data created or modified through an API key is automatically scoped to that subscription.
- You do not need to pass
subscriptionIdas a parameter — it is inferred from the key.
API Key Security
| Practice | Requirement |
|---|---|
| Transmit over HTTPS only | Required |
| Store in environment variables, not source code | Required |
| Rotate keys if compromised | Required — revoke in Admin → API Keys |
| Use separate keys per integration | Strongly recommended |
| Keys have no expiry by default | Revoke manually if no longer needed |
Authentication Errors
| HTTP Status | Error Code | Meaning |
|---|---|---|
401 |
UNAUTHORIZED |
Missing or malformed x-api-key header |
403 |
FORBIDDEN |
Key exists but has been revoked or is invalid |
See Error Handling for the full error reference.
Next Step
→ Your First API Call — Test your key and make a real request.