Introduction

Base URL and versions

https://voxa.abhinavyadav.in/api/v1

Integrations use the versioned API, /api/v1. It is served by the same code as the console's own/api paths, but only /api/v1 is documented and kept backward compatible. Requests and responses are JSON (Content-Type: application/json) except file uploads and downloads. Money is in paise (₹1 = 100 paise). The full spec is at /openapi.json (OpenAPI 3.1).

Authentication

Send an API key with every request, in either header:

curl https://voxa.abhinavyadav.in/api/v1/agents \
  --header 'X-API-Key: vx_your_key'

• X-API-Key: vx_... or Authorization: Bearer vx_...: a workspace API key. Create one in the console under Settings, API keys, or with Create an API key. A key acts as a developer in its workspace and can also read billing.
• Authorization: Bearer vxo_...: the access token of an app connected through OAuth (an MCP client). It acts as the user who connected it, limited to what a key may do. See the MCP server guide.
• Authorization: Bearer <session token>: a signed-in user, from Sign in. Add X-Workspace-ID to pick a workspace (else the first one). Account endpoints, and actions only an owner or admin may take (members, KYC, top-ups), need a session.

Each endpoint page says what it accepts and which permission it needs. Roles and permissions are in Authentication.

Time zones

Every /api/v1 endpoint takes a time zone: the timezone query parameter or the X-Timezone header, an IANA name such as Asia/Kolkata, UTC or America/New_York. The default is Asia/Kolkata. Every timestamp in the JSON response (fields named at, date, timestamp or ending in _at) is returned in that zone as ISO 8601 with its offset, such as 2026-10-01T15:30:00+05:30. The zone used comes back in the X-Timezone response header; an unknown zone is a400.

Errors

Errors use HTTP status codes and a JSON body with a detail message written for people:

{
  "detail": "agent not found"
}

Validation errors (422) list each problem, with where it is:

{
  "detail": [
    {
      "type": "string_pattern_mismatch",
      "loc": [
        "body",
        "to"
      ],
      "msg": "String should match pattern '^\\+?[0-9]{8,15}$'",
      "input": "12"
    }
  ]
}

Every response has an X-Request-ID header; include it when you report a problem.

Rate limits

Each API key (and each connected OAuth app) may make 120 requests per minute by default, counted in fixed one-minute windows. Every response to a keyed request carries the state of the window:

Over the limit, the answer is 429 with Retry-After (seconds): wait that long and retry. Session tokens aren't rate limited this way, but sign-in allows 5 failed attempts per address in 5 minutes. Placing calls has its own limit, the workspace's concurrent calls: extra calls wait in the queue (see Get call limits).

Pagination

Long lists page with limit and skip and answer {"items": [...], "total": n}, newest first, wheretotal counts everything that matches the filters:

Other lists return everything as an array (agents, webhooks, keys, members), or a capped recent window: the last 100 payments, 200 invoices, 50 sessions and 50 limit requests, and an agent's kept versions.

import requests

BASE = "https://voxa.abhinavyadav.in/api/v1"
headers = {"X-API-Key": "vx_your_key"}

skip, calls = 0, []
while True:
    page = requests.get(f"{BASE}/calls", headers=headers, params={"limit": 200, "skip": skip}).json()
    calls += page["items"]
    skip += len(page["items"])
    if not page["items"] or skip >= page["total"]:
        break

Try it in the browser

Paste a key into an endpoint's Try it panel and press Send. The key stays in this browser tab (sessionStorage) and never appears in the code samples. On this site, requests go through doc.voxa.abhinavyadav.in/api/ to the API, so the browser allows them. Requests are real: creating, changing and deleting do just that.

All endpoints

88 endpoints in 10 groups.