DEVELOPERS

Connect to the voice of your customers.

The Wayeel REST API provides organisation-scoped access to surveys, metrics, permitted feedback and consented contacts.

Authentication

Send a bearer token and request JSON. Organisation admins and owners create scoped tokens in Integrations. Tokens expire after three months and can be revoked. Access also depends on the token creator’s active membership, permissions and branch.

Authorization: Bearer YOUR_TOKEN
Accept: application/json
Content-Type: application/json

Keep tokens on your server. Never put them in public browser code or a source repository.

Available endpoints

Method & path	Scope	Purpose
`GET /api/v1/surveys`	surveys:read	Permitted surveys, paginated at 50.
`GET /api/v1/metrics`	metrics:read	Versioned metrics. Optional from, to, survey_id, branch_id filters.
`GET /api/v1/feedback`	feedback:read	Permitted customer and patient responses. Employee responses and contact details excluded.
`POST /api/v1/surveys`	surveys:write	Create a draft. Required title and audience; optional branch_id.
`POST /api/v1/contacts`	contacts:write	Required email and accepted consent; optional name.

Audience is one of customer, employee or patient. Read requests do not publish or send anything.

Request & response examples

Example request to list surveys:

curl https://wayeel.com/api/v1/surveys \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Accept: application/json'

Illustrative paginated response excerpt; identifiers and values below are sample data:

{
  "current_page": 1,
  "data": [{
    "id": 1,
    "title": "Service feedback",
    "audience": "customer",
    "status": "draft",
    "branch_id": null,
    "published_version_id": null
  }],
  "per_page": 50,
  "total": 1
}

Create a draft (does not publish it):

curl -X POST https://wayeel.com/api/v1/surveys \
  -H 'Authorization: Bearer YOUR_TOKEN' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{"title":"Service feedback","audience":"customer"}'

Successful creation returns HTTP 201 with id and url. Validation failures return HTTP 422 with a message and field errors.

Errors & limits

API access is limited to 60 requests per minute per token. Branch access, role permissions and plan quotas also apply.

Status	Meaning	Next step
401	Bearer token missing	Include the Authorization header.
403	Invalid scope, expired/revoked token or denied access	Check token, membership, role and branch.
404	Resource not found within permitted access	Check the resource identifier.
422	Invalid request or unmet application constraint	Read the returned message and field errors.
429	Rate limit reached	Wait before retrying; avoid immediate retry loops.

Signed feedback webhooks

Create a public HTTPS receiver in Integrations. Save its signing secret when shown. Validate X-Wayeel-Signature as a hexadecimal HMAC-SHA256 over X-Wayeel-Timestamp + "." + raw_body using that secret.

Reject timestamps older than five minutes and invalid signatures using a constant-time comparison.
Deduplicate deliveries using X-Wayeel-Event.
Return 2xx after accepting the event; review failed deliveries and retries in your workspace.

The application emits feedback.created events for permitted feedback. Employee responses are excluded. Verify the payload against your receiver in a test environment before relying on it.