Public API, webhooks and integrations: what an event carries, what it never carries, how to authenticate a call, and what a network can automate for itself.
Yes, as a read-only beta. An organization key can read its public profile, public opportunities, and public events with cursor pagination. Business writes, messages, quotes, and pacts are not exposed by this API. Slack and Yousign are managed for the organization; LinkedIn publishing is connected personally in Settings.
For an organization, open its page and choose “Admin dashboard.” You can create an API key, connect Slack, register a signed HTTPS destination, or link Yousign there. Publishing to your LinkedIn profile is personal and is connected under Settings → Personal integrations.
The full key is shown only when it is created. Xoolink stores only its SHA-256 fingerprint, never the clear secret. Each key has explicit permissions, expires after 30, 90 or 365 days, is rate-limited, and can be revoked immediately by a page administrator.
Three permissions are available: organization:read reads the public projection of the organization tied to the key; opportunities:read reads public opportunities; events:read reads public events. A key receives only the permissions selected at creation, and the beta exposes no write permission.
Send Authorization: Bearer xool_live_… from your server, cloud function, or automation secret vault. Never place the key in browser JavaScript, a mobile app, a URL, a screenshot, or a Git repository.
The opportunities and events lists return 20 items by default and up to 50. When meta.next_cursor is present, pass it unchanged as cursor to read the next page. Each key gets 120 requests per minute by default; X-RateLimit-* headers report the remaining allowance and a 429 response includes Retry-After.
An API key lets your system query Xoolink on demand: your system pulls data. A webhook secret verifies an event automatically pushed by Xoolink. They are separate secrets: a xool_live_… key never signs a webhook, and a whsec_… secret can never read the API.
Organization profiles use an explicit allowlist that excludes billing, administrator access, sessions, and precise geographic coordinates. Discreet, withdrawn, demo, or amount-bearing needs are excluded from opportunities. For events, internal host identifiers, avatars, and announcement post IDs remain private. Messages, quotes, pacts, and personal data are not exposed.
A lost key cannot be recovered because Xoolink does not retain its secret. Create a new key, replace the old one in your system, then revoke the former key immediately. An organization can keep up to five active keys so this rotation does not interrupt service.
Only administrators of its page, using a valid Xoolink session. Permissions are checked on the server for every read or change. Base includes 1 key, 1 webhook, and 1,000 API calls per month; Alpha includes 1 key, 2 webhooks, and 10,000 calls; Clan includes 5 keys, 10 webhooks, and 100,000 calls, with extended history and manual replay.
Yes. The human-readable documentation includes curl examples, security rules, pagination, and errors. An OpenAPI 3.1 contract is also available at /api/v1/openapi.json to generate a client or import the definition into your tooling.
Two public lifecycles are covered. Needs use need.created, need.updated, and need.withdrawn. Events use event.created, event.updated, and event.cancelled. A withdrawal or cancellation contains only the identifier, date, and stable link so a CRM can remove it without receiving the content again.
No. Discreet, withdrawn and demo needs are excluded. An event is also blocked when Xoolink suspects an amount in the title, summary or description. Webhooks send no private pact, quote or personal message.
Yes. Slack has a guided two-click connection. Manual setup remains available, as it is for Microsoft Teams: paste the incoming-webhook or workflow URL and choose the language. For HubSpot, Notion, Zapier, Make, or your own server, use the signed standard JSON format. Yousign has its own electronic-signature connection.
Not yet. The admin provides a guided recipe that preselects a read-only Xoolink API key and the public webhook lifecycles. A server-side relay, cloud function, or automation tool then verifies the signature and writes to HubSpot or Notion using that platform’s own authorization. Xoolink never asks for or retains your HubSpot or Notion key.
Keep data.id in a unique “Xoolink ID” field and upsert instead of always creating a record. Also deduplicate retries with X-Xoolink-Event-Id. The need.withdrawn and event.cancelled lifecycles should mark the record withdrawn or cancelled without rebuilding content that is no longer public.
This is not about your personal Slack account: you authorize Xoolink to post in ONE channel of your organization’s workspace. From the organization dashboard, an administrator clicks “Choose a Slack channel,” authorizes Xoolink, then selects the workspace and channel. Slack sends the destination directly to Xoolink, so there is no webhook URL to copy. Xoolink requests only the access needed for the chosen channel, retains no Slack OAuth token, and encrypts the destination URL. Once a channel is connected, the block reads “Slack is connected” and offers to add another.
The channel receives the public signals enabled by the administrator. Needs include creation, update, or withdrawal with a readable summary and requested expertise. Events include creation, update, or cancellation with date, location, and a Xoolink link. Discreet or demo needs, private messages, quotes, pacts, documents, and amounts are never sent.
It turns a public organization profile or shareable pack card into proof you can share with your professional network. The post links back to the matching Xoolink page to give visibility to an organization, alliance, or result. It does not synchronize the Xoolink and LinkedIn feeds.
On a public organization profile or shareable pack card, click LinkedIn. Xoolink first opens a preview with editable text, your identity, public visibility and the Xoolink link card. Nothing is sent until you explicitly click “Post now.” The post then appears publicly on your personal LinkedIn profile.
No. Every post requires your explicit confirmation. Only the confirmed text, title, and public Xoolink link are sent to LinkedIn. Xoolink does not read your feed or contacts. Each submission is protected against duplicates after a double click or uncertain network response. Base keeps the regular LinkedIn share flow; connected publishing is included with Alpha or a Clan seat.
Xoolink deletes your authorization and the encrypted token stored server-side. Posts already sent remain on LinkedIn and must be deleted from LinkedIn if you no longer want them. In Xoolink, the button then returns to the regular LinkedIn sharing flow without direct publishing.
Not in this first version. It publishes only to the profile of the member who granted consent. Publishing as a Page requires a separate LinkedIn permission and an administrator role on that Page; Xoolink never assumes that authority.
The Xoolink pact records member consent and commitments inside the Pack. It must be sealed first. Yousign is an optional and separate legal step: after sealing, the lead can send the document to the same members from its organization’s Yousign account. Xoolink never signs or accepts a commitment on anyone’s behalf.
An administrator opens the page dashboard, finds “Electronic signature,” then enters the environment, an API key, a template ID, and its ordered signer labels. Xoolink encrypts the key. The Yousign webhook must then be created with the URL and one-time secret shown by Xoolink. Start in Sandbox before switching to Production.
No. An administrator connects the lead organization’s Yousign account once. When the document is sent, each signer receives a personal link by email and normally does not need a Yousign account. Depending on the template settings, Yousign may require email or SMS verification.
Only the Pack lead can start the request, after every positioned member has consented and the Xoolink pact is sealed. Xoolink validates the names, email addresses, and template placeholders, then creates the Yousign request. No document is sent or signed automatically on a member’s behalf.
The Yousign connection is available to an Alpha administrator or a Clan organization. The organization uses its own Yousign subscription and signature credits, billed separately by Yousign. Members receiving a signature request need neither a paid Xoolink plan nor their own connected Yousign account.
Every request carries an HMAC SHA-256 signature in X-Xoolink-Signature. Verify it against the raw body with the secret shown at creation, compare in constant time and reject timestamps older than five minutes. The secret is displayed once and stored encrypted by Xoolink.
An HTTP 2xx response received within eight seconds confirms delivery. Otherwise Xoolink retries with exponential delay, up to eight attempts. Your system should deduplicate retries with X-Xoolink-Event-Id; the log also lets an administrator replay a delivery.
Use “Replace secret” in the admin workspace, then immediately update the destination. The former secret stops working as soon as it is rotated. Use “Test” to confirm the new setup before waiting for a real event.