Skip to content
Integrations & API

Build on Callario. Let its AI reach your systems.

Connect the apps your business runs on with your own keys — Shopify, Salla, Stripe, Jira, HubSpot, Slack, Microsoft Teams, Resend and Cal.com. Your workflows act in all of them, and the AI agent acts in your store and calendar directly, asking a teammate before anything irreversible. Any other REST API is a “Call an API” step away, MCP servers add their tools, and a scoped REST API and signed webhooks carry the rest.

Get early accessBook a demo
  • Scoped keys, shown once and stored as a hash
  • HMAC-SHA256 signatures with a signed timestamp
  • Six attempts with back-off, then one-click replay
Public API · /papi/v1600 req / min per IP
  • GET/ticketstickets:read
  • GET/tickets/:idtickets:read
  • POST/ticketstickets:write
  • GET/contactscontacts:read

Request

POST /papi/v1/tickets
Authorization: Bearer ck_3f9a1c…

{
  "subject": "Arrived damaged",
  "requesterEmail": "maya@example.com",
  "priority": "high",
  "type": "incident"
}

Response201 Created

{
  "id": "6b0e2d7a-…",
  "number": 1042,
  "status": "open",
  "priority": "high",
  "origin": "api",
  …
}
Warehouse sync · ck_3f9a1c…tickets:read, tickets:write · used 2 min ago

01Webhooks

Events you can verify.
Deliveries you can see.

Point an HTTPS endpoint at the events you need — by name, by prefix such as conversation.ticket.*, or all of them. Every delivery is signed over its timestamp and body, retried with back-off while your endpoint is down, and logged with its status and response code, so nothing fails quietly.

  • A stable event id on every delivery, for de-duplication
  • Rotate the signing secret in one step; it is shown once
  • Public HTTPS endpoints only — private addresses are refused
hooks.northwind.example/callario

Subscribed to

  • conversation.ticket.*
  • ai.resolution.verified
  • csat.responded
  • ticket.sla.breached
x-callario-signature: t=1759561200,v1=5d1f…a07c
x-callario-event-id: 9f2c41e0-…

Deliveries

  • conversation.ticket.createddelivered
  • csat.respondeddelivered
  • ticket.sla.breachedfailed
  • ai.resolution.verifieddeadReplay

Each attempt is signed when it is sent, so a retry or a replay days later still carries a fresh timestamp your receiver will accept.

02AI tools

Your AI can look it up.
In your systems, for the right customer.

Register one context endpoint and the agent can answer “where is my order?” from your own data. It sends a signed request for an order, shipment, return or account — only for a customer whose identity your site has signed — and answers from what you return. For anything else, connect the app — Shopify, Salla, Stripe and the rest — or give it a procedure with a “Call an API” step, or an MCP server.

  • No verified identity, no lookup — the AI can’t pick whose record to read
  • An unavailable record is said plainly, never guessed
  • Tools that change things work only in Autonomous mode

Where’s my order A-10023?

Maya Rivera · identity signed by your site
Look up a recordRead-only

POSTapi.northwind.example/callario/context

{ "type": "order", "ref": "A-10023",
  "contactRef": "email:maya@example.com" }
{ "found": true,
  "summary": "Shipped 3 Oct, arriving 6 Oct." }
  • Signed request ✓
  • Wrong signature refused ✓
  • Stale timestamp refused ✓

“Send test” — all three must pass.

Order A-10023 shipped on 3 October and should arrive on 6 October.

HTTP request toolYour API, called by the agent in Autonomous mode or by a workflow step

03Import & export

Bring your customers in.
Take your data out.

Import customers and companies from CSV — mapped to your fields, matched to existing records, run in the background and reversible. Import help-centre articles from PDF, Markdown, text or HTML with their structure intact. Export customers, reports and a customer’s GDPR data whenever you need them.

  • Up to 20,000 rows per file, for customers or companies
  • Revert a whole import in one step
  • Articles keep their headings, lists and links
Import customerscustomers.csv
  • emailEmailMatch key
  • full_nameName
  • companyCompany
  • plan_tierTier · custom field
Running in the background8,200 / 12,480 rows
Matches update existing customersRevert
  • Help-centre articlesPDF · Markdown · text · HTML
  • ExportsCustomers CSV · reports CSV · GDPR export

Up to 20,000 rows per file, for customers or companies.

04Everything in the box

Connected apps, and the plumbing
done properly.

  • Shopify & SallaOrders, products, carts with a checkout link, address changes, returns; Salla coupons as a workflow step.
  • StripeWorkflow steps: look up a customer, and refunds a teammate approves before they are sent.
  • Slack, Teams, Jira, HubSpotPost messages, create Jira issues and HubSpot contacts from a workflow, or a procedure your AI agent runs.
  • Cal.comFree slots, booking, rescheduling and cancelling — confirmed by the customer.
  • Resend emailSend an email from a workflow step, through your own Resend account.
  • MCP serversConnect an MCP server; the tools an admin marks public can be granted to the agent.
  • REST APIList, read and create tickets; list contacts — at /papi/v1.
  • Scoped API keystickets:read, tickets:write, contacts:read. Shown once, hashed, revocable.
  • Rate limiting600 requests a minute per IP address, on top of key authentication.
  • Signed webhooksHMAC-SHA256 over a timestamp and the body, in x-callario-signature.
  • 40+ eventsTickets, messages, SLAs, chats, CSAT, AI resolutions, customers and workflows.
  • Retries & replaySix attempts with exponential back-off; replay any delivery from the log.
  • Secret rotationNew signing secrets for webhooks and the context endpoint, in one step.
  • Context endpointSigned lookups of orders, shipments, returns and accounts for the agent.
  • Call an APIAny REST API, for agents and workflow steps: public addresses only, timed out, size-capped.
  • Webhooks from rulesBusiness rules and workflows can call your webhook as an action.
  • ImportsCustomers and companies by CSV; articles from PDF, Markdown, text or HTML.
  • Audited changesKey creation and revocation, webhook edits, rotations and replays are logged.

Not built yet

  • Salesforce
  • Zendesk or Intercom importer

05Straight answers

What your engineers
will ask before they start.

Can we import our history from Zendesk or Intercom?
Not yet — there is no Zendesk or Intercom importer, and past tickets do not come across. What you can import today: customers and companies from CSV (up to 20,000 rows a file, matched to existing records and reversible), and help-centre articles from PDF, Markdown, text or HTML files.
What can the public API do today?
It is deliberately small: list, read and create tickets, and list contacts, with keys scoped to tickets:read, tickets:write and contacts:read. A ticket created through it is marked as coming from the API. Updating tickets, posting replies and reading reports are not in the public API yet.
How do we check that a webhook really came from Callario?
Read t and v1 from the x-callario-signature header, compute HMAC-SHA256 with your endpoint’s secret over the timestamp, a full stop and the raw body, compare in constant time, and reject anything more than five minutes old. Use x-callario-event-id to ignore a delivery you have already processed.
What happens when our endpoint is down?
A delivery is retried up to six times, waiting 30 seconds and doubling each time up to an hour. After the last attempt it is marked dead and stays in the log, where you can replay it. Every attempt is signed when it is sent, with the current secret and a fresh timestamp.
Can the AI agent change things in our systems?
Only if you let it. Store and calendar actions, procedures and MCP tools are granted per agent. The customer confirms on a card in the chat before an action runs, and irreversible ones — cancelling an order, sending a refund — wait for a teammate’s approval. Lookups only read the customer’s own records, and every tool call is recorded.
Do you have native Slack, Shopify or HubSpot connectors?
Yes. Shopify, Salla, Stripe, Jira, HubSpot, Slack, Microsoft Teams, Resend and Cal.com connect with your own key or token. Their actions are workflow steps, and the AI agent uses the Shopify, Salla and Cal.com ones directly. For anything else, “Call an API” reaches any REST API and MCP servers add their tools.

Works with the rest of Callario

WorkflowsApp actions, “Call an API” steps and webhooks.AI AgentThe agent that looks records up for verified customers.Contacts & CRMWhere CSV imports and contact events come from.Reporting & QAThe verified resolutions and CSAT your webhooks carry.
Design-partner programme · now onboarding

Put it in front of
real customers.

We’re onboarding a small group of teams ready to run their support on Callario’s AI — and to tell us where it breaks. Bring your real conversations; we’ll bring the platform and the people who build it.

Get early accessBook a demo
  • No training on your data
  • English and Arabic
  • Human takeover, any time

What design partners get

  • The whole platform, set up with youAI agent, copilot, workflows, inbox and knowledge — configured around your real conversations.
  • A direct line to the buildersTalk to the people who write the code, not a support queue.
  • A say in what ships nextYour feedback shapes the roadmap, week by week.