Administrative API & Permissions

This page answers a common pre-purchase question: "Does XSender have an Admin REST API so I can manage users, plans, devices, or gateways from another system?"

Short answer: partially. XSender's HTTP surface is intentionally focused on messaging — the things you do every minute. Administrative actions (CRUD on users, plans, gateways, settings) live in the admin panel because they are configured rarely and are security-sensitive. Below is a precise breakdown of what is exposed today, what is not, and how to achieve common "admin from outside" goals.

What is exposed today

CapabilityAvailable via API?Endpoint
Send Email / SMS / WhatsApp✅ YesPOST /api/{channel}/send
Read dispatch / log status✅ YesGET /api/get/{channel}/{uid}
Trigger an automation workflow✅ Yes (webhook)POST /api/automation/webhook/{id}
Receive ESP delivery events✅ Yes (webhook)POST /api/webhook/email/{provider}
Capture Meta / Google Lead Ads✅ Yes (webhook)POST /api/webhook/meta-lead-ads, POST /api/webhook/google-ads-lead
Register / re-link an Android device✅ YesPOST /api/gateway/sms/android/register-session
Manage SIMs on a device✅ Yes/api/gateway/sms/android/sim/*
Create / suspend / delete a user❌ Admin panel only
Assign a plan, top-up credit❌ Admin panel only
Add / edit a gateway, change credentials❌ Admin panel only
Edit global settings (SMTP, app URL, branding)❌ Admin panel only

Admin-scope vs user-scope API key

The same POST /api/{channel}/send endpoint behaves differently depending on which key you authenticate with:

User keyAdmin key
Gateways availableUser's own gateways + ones the admin shared with themAll admin-configured gateways
Plan / credit enforcementYes — credit is deducted, quota is enforcedNo — admin sends bypass plan limits
Counts against analyticsYes — under that userYes — under "admin" tenant
Webhook source identificationuser_id populateduser_id = null, by_admin = true

Use the admin key for system-of-record traffic that should never fail due to plan limits (your own transactional emails, internal notifications). Use a user key for everything tenant-attributable.

Common "admin from outside" patterns

1. Provision a new tenant from your billing platform

Today this requires either:

A formal Admin REST API for user/plan CRUD is on the v4.6 roadmap. If you need it sooner, get in touch — most installations have shipped a thin add-on package that exposes exactly the admin endpoints they need, secured with mTLS or IP allow-list.

2. Push an event into a workflow without granting full API access

Use the Automation Trigger Webhook — see Webhooks — Incoming Triggers. The unguessable per-workflow URL means you can hand it to a third-party platform without sharing your master API key.

3. Onboard a phone fleet

For 1–10 phones, pair each by QR scan in the admin panel. For larger fleets, use the Android SMS Gateway API's register-session endpoint — your MDM (Mobile Device Management) software can push pairing tokens to devices at provisioning time.

4. Replicate gateway configs across installations

Not currently available over HTTP. Use the bundled Schema Reconciler / settings export CLI tool — see the Configuration section.

Permissions model (panel-side)

For completeness, the admin panel itself supports role-based access:

These roles do not yet bind to API tokens — every API key carries the full permissions of its owner.

Hardening the admin surface

Need an endpoint that isn't here?

Tell us your use case in the support channel. The Admin REST API is being expanded for v4.6, and prioritisation is driven by real-world requests.