> ## Documentation Index > Fetch the complete documentation index at: https://docs.firetone.com.au/llms.txt > Use this file to discover all available pages before exploring further. # List contacts > Customers, one per external number per organisation. Base architecture rather than an app: a tenant who disables tickets still has customers, so there is no enablement gate. Default sort is last_seen descending. Sort keys: last_seen, first_seen, e164, name, created_at. ## OpenAPI ````yaml /api-reference/openapi-public.json get /contacts openapi: 3.0.3 info: description: >- The API your own systems use: place and follow calls, have an AI agent call someone, run campaigns and get their results, keep contacts in step with your CRM, and receive signed webhooks. Authenticate with an integration key (Authorization: Bearer ft_...), used only from the IP addresses it allows. title: FireTone API version: 0.1.0 servers: - description: Your platform's API host url: https://{host}/api/v1 variables: host: default: api.firet.one security: - bearerAuth: [] tags: - name: Auth - description: >- Live calls and what can be done to them: hang up, hold, transfer, park, merge, monitor, whisper; the Desk's own call. name: Calls - description: 'Outbound campaigns: contacts, attempts, outcomes.' name: Campaigns - description: 'Customers: who called, what is known about them, and their memory.' name: Contacts - description: What was said on an AI call, and the review of it. name: Conversations - description: >- Your own systems: HTTP connections an IVR calls mid-call, and webhooks for call events. Tenant URLs must be public https addresses. name: Integrations - name: Live - name: Provisioning - name: Reporting - description: Tickets raised by people, agents and the API. name: Tickets - description: Messages left for an extension or a queue. name: Voicemail paths: /contacts: get: tags: - Contacts summary: List contacts description: >- Customers, one per external number per organisation. Base architecture rather than an app: a tenant who disables tickets still has customers, so there is no enablement gate. Default sort is last_seen descending. Sort keys: last_seen, first_seen, e164, name, created_at. operationId: getContacts parameters: - $ref: '#/components/parameters/limit' - $ref: '#/components/parameters/offset' - $ref: '#/components/parameters/sort' - $ref: '#/components/parameters/order' - $ref: '#/components/parameters/q' responses: '200': content: application/json: schema: $ref: '#/components/schemas/ContactPage' description: OK '400': $ref: '#/components/responses/BadRequest' '403': $ref: '#/components/responses/Forbidden' components: parameters: limit: in: query name: limit schema: default: 50 maximum: 500 type: integer offset: in: query name: offset schema: default: 0 type: integer sort: description: >- Sort key. Each list accepts its own allow-list of keys, given in that endpoint's description; anything else is a 400. ORDER BY cannot be parameterised, so the key is looked up rather than interpolated. Every sort carries a tiebreak on the primary key, so paging stays disjoint when the sort column has duplicates. in: query name: sort schema: type: string order: description: >- Sort direction. Defaults to ascending, except the call log, which reads newest first. in: query name: order schema: enum: - asc - desc type: string q: description: >- Free-text search across the list's searchable columns (case-insensitive substring). % and _ in the term match themselves. in: query name: q schema: type: string schemas: ContactPage: properties: items: items: $ref: '#/components/schemas/Contact' type: array limit: type: integer offset: type: integer total: type: integer type: object Contact: properties: attributes: description: >- Tenant-owned structured fields: account number, language, plan. Distinct from memory, which is what was learned in conversation. type: object call_count: type: integer created_at: format: date-time type: string dnc: type: boolean e164: type: string external_ref: description: >- A CRM's own id for this contact (PUT /contacts/by-reference/{reference}). type: string first_seen: description: >- Not created_at: a contact may be imported from a CRM long before they ever call. format: date-time nullable: true type: string id: format: uuid type: string last_seen: format: date-time nullable: true type: string name: type: string organisation_id: format: uuid type: string type: object Error: properties: error: properties: code: enum: - invalid_request - invalid_credentials - unauthenticated - forbidden - not_found - conflict - internal type: string message: type: string required: - code - message type: object required: - error type: object responses: BadRequest: content: application/json: schema: $ref: '#/components/schemas/Error' description: The request is not valid. The message names every field that is wrong. Forbidden: content: application/json: schema: $ref: '#/components/schemas/Error' description: Outside the caller's scope, or insufficient role securitySchemes: bearerAuth: bearerFormat: JWT or API key description: >- Every request sends `Authorization: Bearer `. The token is either a panel session (a JWT from /auth/login, 12 hours) or an API key `ft__`. An API key is accepted only from an address on its IP allowlist (403 ip_not_allowed otherwise; 403 ip_allowlist_required for an old key that has none), is limited to its rate per minute (429 rate_limited with Retry-After; X-RateLimit-Limit/Remaining/Reset on every response), and at most 60 call placements a minute. scheme: bearer type: http ````