# REST

Base path `/api/v1`. Header `Authorization: Bearer da_test_...` or `da_live_...`.

The machine-readable reference is [`/openapi.json`](/openapi.json).

| Method | Path | Purpose |
| --- | --- | --- |
| POST | /api/v1/signup | Create a sandbox org and return an API key once |
| POST | /api/v1/contacts | Create a contact. Include consent or drops stay blocked |
| POST | /api/v1/contacts/:id/consent | Record consent source, text, and method |
| POST | /api/v1/dnc | Add a number to the internal DNC list |
| POST | /api/v1/audio | TTS script or base64 wav/mp3 |
| POST | /api/v1/drops | One ringless or AMD-fallback drop |
| POST | /api/v1/drops/bulk | Dry-run unless dryRun is false and confirmToken is set |
| GET | /api/v1/drops/:id | Status, ring flag, follow-up messages |
| POST | /api/v1/sms | One SMS. Body must include STOP |
| POST | /api/v1/sequences | Multi-step SMS after a delivered drop |
| PATCH | /api/v1/settings | Caps, kill switch, calling hours, webhook, carrier |

Webhooks use `X-DropAgent-Signature: t=<unix>,v1=<hex>` over `timestamp + "." + raw body`.