Arraxis API

Version 1. Create and read leads, move a lead along your pipeline, add notes, and get told when something changes.

Start here

In Arraxis open Settings, then Lead sources, then Keys for other apps, and press Make a key. Copy it straight away: for your safety Arraxis shows it only once. Every call goes to this address:

https://app.arraxis.site/api/v1

Check that your key works:

curl -H "Authorization: Bearer arx_live_YOUR_KEY" https://app.arraxis.site/api/v1/whoami

Everything is JSON. Field names are snake_case, times are ISO 8601 in UTC (2026-09-30T09:12:44.120Z), and an empty value is null, never a dash. Fields you send that Arraxis does not know are ignored; fields Arraxis adds to its answers later must be ignored by your code too.

Authentication

Send the key in the header Authorization: Bearer <key>. Never put it in the address: a key in the address is refused (400) because addresses end up in logs. A key can only do what was ticked when it was made:

• leads:read: read leads, stages, sources and fields.
• leads:write: add leads, change a lead's stage, add notes. A key that cannot also read gets back only { "id", "url" } from these calls, never a lead's details.
• hooks:manage: register and remove addresses that receive events. Those addresses receive each lead's full details.

A key acts on the whole workspace, money values included. Keep it secret like a password. An owner or manager can switch a key off at any time; if the person who made a key leaves the team, the key is paused until an owner turns it back on.

Errors

Every error is application/problem+json (RFC 9457): type, title, status, detail (what to fix, in plain words), code, request_id and, for 400 and 422, errors[] with the field name of each problem. Quote the request_id when you ask for help.

Idempotency

Every POST accepts an Idempotency-Key header (1 to 200 visible characters). Send the same key with the same body and you get the first answer back, with the header Idempotency-Replayed: true, for 24 hours. The same key with a different body is a 409. Use something unique per event, such as your entry id. Creating a lead also has its own protection: send external_id (unique per source) and a repeat returns the same lead.

Pagination

Lists are newest first. limit is 1 to 100 (25 by default). The answer is { "data": [...], "has_more": true, "next_cursor": "..." }; pass next_cursor as cursor to get the next page, with the same filters. Pages never skip or repeat a lead that did not change. To poll for changes use updated_since.

Rate limits

A key may make 120 requests a minute. Every answer carries X-RateLimit-Limit and X-RateLimit-Remaining; over the limit you get 429 with Retry-After (seconds). The API sends no CORS headers: call it from a server, never from a browser page. Changes inside version 1 only ever add things.

Endpoints

{
  "name": "Alex Morgan",
  "phone": "+1 555 0100",
  "email": "alex.morgan@example.com",
  "service": "Consultation",
  "location": "Downtown",
  "source": "api",
  "external_id": "typeform-8812",
  "attribution": {
    "utm_source": "facebook"
  }
}

{
  "outcome": "created",
  "lead": {
    "id": "6f1c2d0e-8a41-4b7e-9c55-3e2f1a9b7c10",
    "url": "https://app.arraxis.site/leads/6f1c2d0e-8a41-4b7e-9c55-3e2f1a9b7c10",
    "created_at": "2026-09-30T09:12:44.120Z",
    "updated_at": "2026-09-30T09:12:44.120Z",
    "received_at": "2026-09-30T09:12:44.120Z",
    "name": "Alex Morgan",
    "phone": "+15550100",
    "phone_raw": "+1 555 0100",
    "email": "alex.morgan@example.com",
    "city": null,
    "gender": null,
    "age": null,
    "stage": {
      "key": "new",
      "name": "New",
      "kind": "new"
    },
    "source": {
      "id": "a41f0b7c-0000-4000-8000-000000000001",
      "key": "api",
      "name": "API",
      "kind": "api"
    },
    "owner": null,
    "service_interest": "Consultation",
    "service": null,
    "location": "Downtown",
    "tags": [],
    "custom": {
      "preferred_time": "Morning"
    },
    "value": null,
    "booked_at": null,
    "landed_at": null,
    "won_at": null,
    "lost_at": null,
    "next_action_at": "2026-09-30T09:12:44.120Z",
    "external_id": "typeform-8812",
    "attribution": {
      "utm_source": "facebook",
      "utm_campaign": "autumn-offer"
    },
    "answers": {},
    "ads": {
      "platform": null,
      "campaign_id": null,
      "campaign_name": null,
      "adset_id": null,
      "ad_id": null,
      "form_id": null
    },
    "duplicate_of": null
  }
}

{
  "id": "6f1c2d0e-8a41-4b7e-9c55-3e2f1a9b7c10",
  "url": "https://app.arraxis.site/leads/6f1c2d0e-8a41-4b7e-9c55-3e2f1a9b7c10",
  "created_at": "2026-09-30T09:12:44.120Z",
  "updated_at": "2026-09-30T09:12:44.120Z",
  "received_at": "2026-09-30T09:12:44.120Z",
  "name": "Alex Morgan",
  "phone": "+15550100",
  "phone_raw": "+1 555 0100",
  "email": "alex.morgan@example.com",
  "city": null,
  "gender": null,
  "age": null,
  "stage": {
    "key": "new",
    "name": "New",
    "kind": "new"
  },
  "source": {
    "id": "a41f0b7c-0000-4000-8000-000000000001",
    "key": "api",
    "name": "API",
    "kind": "api"
  },
  "owner": null,
  "service_interest": "Consultation",
  "service": null,
  "location": "Downtown",
  "tags": [],
  "custom": {
    "preferred_time": "Morning"
  },
  "value": null,
  "booked_at": null,
  "landed_at": null,
  "won_at": null,
  "lost_at": null,
  "next_action_at": "2026-09-30T09:12:44.120Z",
  "external_id": "typeform-8812",
  "attribution": {
    "utm_source": "facebook",
    "utm_campaign": "autumn-offer"
  },
  "answers": {},
  "ads": {
    "platform": null,
    "campaign_id": null,
    "campaign_name": null,
    "adset_id": null,
    "ad_id": null,
    "form_id": null
  },
  "duplicate_of": null
}

{
  "stage": "booked",
  "date": "2026-10-02",
  "time": "11:00",
  "service": "Consultation"
}

{
  "text": "Called back, will decide on Friday."
}

{
  "url": "https://hooks.zapier.com/hooks/standard/123/abc/",
  "events": [
    "lead.created"
  ]
}

curl -X POST https://app.arraxis.site/api/v1/leads \
  -H "Authorization: Bearer $KEY" -H "Content-Type: application/json" -H "Idempotency-Key: typeform-8812" \
  -d '{"name":"Alex Morgan","phone":"+1 555 0100","service":"Consultation","location":"Downtown","source":"api","external_id":"typeform-8812"}'

Webhooks

Arraxis can send each new lead, and other changes, to an address you register: paste it in Settings, Lead sources, Send leads to other apps (press Send a test to see one arrive), or register it through the API (POST /hooks). Each message is an HTTPS POST of JSON. Answer with any 2xx. Anything else is retried 8 times over about 31 hours (1 minute, 5 minutes, 30 minutes, 2, 5, 10 and 14 hours); a 410 answer switches the address off at once, and an address that has failed for 3 days is switched off and your owners are told. Redirects are never followed. Messages older than 7 days cannot be sent again.

The body is { id, type, timestamp, workspace_id, actor, data }. id is the same for every address and every retry: dedupe on it (or on webhook-id). data.lead is the full lead as it is when the message is built; data.change holds the event's own facts (for a stage change, from and to stage keys). actor says who caused it: a Zap that writes back to Arraxis can ignore events whose actor.kind is api_key to avoid a loop.

{
  "id": "evt_1c7e2d4a-3f1b-4a51-9a0c-2b9d8e7f6a51",
  "type": "lead.stage_changed",
  "timestamp": "2026-09-30T10:04:11.502Z",
  "workspace_id": "0b1e5c3a-…",
  "actor": {
    "kind": "member"
  },
  "data": {
    "lead": {
      "id": "6f1c2d0e-…",
      "name": "Alex Morgan",
      "phone": "+15550100",
      "stage": {
        "key": "booked",
        "name": "Booked",
        "kind": "booked"
      },
      "…": "the full lead"
    },
    "appointment": null,
    "note": null,
    "change": {
      "from": "new",
      "to": "booked",
      "amount": null,
      "reason": null
    }
  }
}

Messages follow the Standard Webhooks signing scheme. Each carries three headers: webhook-id (msg_…, the same on every retry), webhook-timestamp (unix seconds of this attempt) and webhook-signature (v1,<base64>; two values separated by a space while you are replacing a secret). The signature is an HMAC-SHA256 of id.timestamp.body with your signing secret (whsec_…, base64-decoded). Verify it against the raw body, refuse timestamps more than 5 minutes old, and answer 2xx only after that:

// Node (no library)
import { createHmac, timingSafeEqual } from "node:crypto";
export function verifyArraxis(secret, headers, rawBody) {
  const id = headers["webhook-id"], ts = headers["webhook-timestamp"], sigs = String(headers["webhook-signature"] || "");
  if (!id || !ts || Math.abs(Date.now() / 1000 - Number(ts)) > 300) return false;
  const want = Buffer.from("v1," + createHmac("sha256", Buffer.from(secret.replace(/^whsec_/, ""), "base64")).update(`${id}.${ts}.${rawBody}`).digest("base64"));
  return sigs.split(" ").some((s) => { const got = Buffer.from(s); return got.length === want.length && timingSafeEqual(got, want); });
}

// PHP
function arraxis_verify(string $secret, array $h, string $raw): bool {
  $id = $h['webhook-id'] ?? ''; $ts = $h['webhook-timestamp'] ?? ''; $sigs = $h['webhook-signature'] ?? '';
  if ($id === '' || abs(time() - (int)$ts) > 300) return false;
  $key = base64_decode(preg_replace('/^whsec_/', '', $secret));
  $want = 'v1,' . base64_encode(hash_hmac('sha256', "$id.$ts.$raw", $key, true));
  foreach (explode(' ', $sigs) as $s) if (hash_equals($want, $s)) return true;
  return false;
}

Zapier's "Catch Hook" and Make's "Custom webhook" do not check signatures, so for them the unguessable address is the credential: keep it private.

Zapier

Leads into Arraxis: make a key that can add leads. In your Zap use Webhooks by Zapier, POST to https://app.arraxis.site/api/v1/leads with payload type JSON; data name, phone, email, service and external_id (the trigger's entry id); headers Authorization: Bearer arx_live_… and Idempotency-Key (the entry id). Give each app its own source, or prefix the id with the app name, because external_id is unique per source. The test step sends a real lead: delete it afterwards or test with your own number.

Leads out of Arraxis: in Zapier start with Webhooks by Zapier, Catch Hook and copy its address. In Arraxis paste it under Send leads to other apps, tick New lead, save and press Send a test; then press Test trigger in Zapier to see the sample lead's fields.

A private Zapier integration can subscribe for you: POST /hooks with { "url": "{{bundle.targetUrl}}", "events": ["lead.created"] } to subscribe, DELETE /hooks/{id} to unsubscribe, and GET /hooks/sample?event=lead.created for the editor's sample data. The key needs all three permissions.

Make

Into Arraxis: use HTTP, Make a request: URL https://app.arraxis.site/api/v1/leads, method POST, headers Authorization and Idempotency-Key, body type Raw, content type JSON, and Parse response: Yes. A 422 answer names the field that is wrong in errors[].field.

Out of Arraxis: use Webhooks, Custom webhook, copy its address, paste it under Send leads to other apps, press Redetermine data structure in Make and Send a test in Arraxis. Make turns off a webhook that is not attached to a scenario for 5 days and then answers 410; Arraxis then switches the address off.

WordPress plugin

Arraxis Leads sends your website's form submissions (Contact Form 7, WPForms, Gravity Forms, Elementor, Fluent Forms, Forminator) to Arraxis, with the page they were sent from and the ad click ids of the visit. Download it from Settings, Lead sources, add a WordPress website source, upload the zip in wp-admin under Plugins, Add New, Upload Plugin, then paste the key shown in Arraxis under Settings, Arraxis Leads. Nothing is sent until you connect a key and tick a form. The plugin is also at https://app.arraxis.site/wp-plugin/arraxis-leads/arraxis-leads.zip.

The same reference in machine-readable form: openapi.json (OpenAPI 3.1).