Skip to main content
Developer, in your panel’s sidebar, is where you build against the API. It’s for organisation admins, and follows the organisation chosen in the sidebar.

​
API keys

Create integration keys from a preset, with the IP addresses they may be used from. Each key shows when it was last used, from where, and the last address it was refused from. Keys made before allowlists were compulsory are flagged, with the addresses they’ve been seen using offered to allow. See Authentication. Addresses shows two things:
  • your API’s address, for example https://api.firet.one/api/v1;
  • the addresses FireTone’s webhooks and callbacks come from, to allow on your receiver.

​
Console

Try any operation in the public API from your browser. This replaces a Swagger page.
  • A form for each operation, with its parameters and a starting request body.
  • The same request as curl, so you can copy it into your code.
  • The response, including the rate-limit headers and whether an Idempotency-Key answer was replayed.
  • Runs as you, or as an API key you paste. A pasted key is kept on the page only. It then meets its IP allowlist from your browser’s address, exactly as your integration would.
  • Calls and campaign starts run as a dry run by default. Placing a real call needs a second tick. Even then, the console rings only your own extensions and verified test numbers, so trying the API never rings a customer.
  • Deletes need you to type delete.

​
Webhooks & callbacks

  • Your webhooks, with the event picker, the delivery log, each delivery’s exact body, and Send again.
  • The callback signing secret, used for per-call callback_url and campaign result_callback_url. Create or rotate it here; it’s shown once.

​
Callback inbox

A URL that keeps whatever is posted to it for 24 hours: up to 200 requests of up to 64 KB each.
  1. Point a callback_url, a campaign’s result URL or a webhook at it.
  2. See each request’s headers and body, and which secret signed it: your callback secret, a particular webhook, or none that matched.
It shows what your receiver will get before you’ve written one. The Node verification snippet is beside it.

​
Request log

Every request made with an API key for the last 7 days, including refused ones, plus requests from the console. Each row shows:
  • the method, path, status and error code;
  • which key, and the address it came from;
  • how long it took.
Filter to errors or to requests refused by an IP allowlist: the first place to look when “the integration does nothing”. Request bodies are never kept.

​
Test numbers

Up to five of your own phone numbers that the console may ring for real.
  1. Add a number. A code is sent to it: by text if your organisation has an SMS account, otherwise by a call that reads the code out.
  2. Enter the code to verify it. Codes last 15 minutes, and five wrong tries means sending a new one.