Postman Collection & Quickstart Guide¶

The fastest way to explore, test, and integrate the Abelo REST API is through our official Postman collection and public workspace.

1. Quickstart: Open in Postman¶

The fastest and recommended way to get started is to fork our official collection directly in the Postman Public Workspace. When you fork from our public workspace, Postman automatically notifies you of new endpoints, schema changes, and parameter updates as our API evolves.

2. Configuring Environment Variables¶

Once you have imported or forked the collection, activate the Abelo API (Production) environment and configure the following variables:

3. Built-In Pre-Request Script Automation¶

The collection includes a pre-request script at the collection root that handles authentication for every request:

• When authMethod is set to bearer: It automatically constructs the Authorization: Bearer <apiKeyId>:<apiKeySecret> header.
• When authMethod is set to hmac: It automatically generates the required HMAC-SHA256 signature headers:
• X-Abelo-Key-Id: Your API Key ID.
• X-Abelo-Timestamp: Current UTC Unix timestamp.
• X-Abelo-Signature: Computed signature using CryptoJS.HmacSHA256(canonicalString, hmacSecret).

This enables you to switch between standard Bearer tokens and enterprise cryptographic HMAC signing by changing a single variable in your Postman environment.

4. Pre-Configured Endpoints Included¶

The collection is organized by resource and contains ready-to-execute requests for all primary API operations:

Messages (/v1/messages)¶

• Send Viber Message (with SMS Failover): Dispatch transactional and promotional messages with dynamic parameters ({{params}}), custom recipient lookup, and client references.
• Send OTP Verification: Trigger instant 2FA authentication alerts with required non-empty PIN validation.

Profiles (/v1/profiles)¶

• Create Profile: Create unified customer profiles with phone numbers, emails, attributes, and marketing consent (viber_consent, sms_consent).
• Get Profile by ID: Inspect profile data and current consent state.
• List Profiles: Search customer profiles by phone number or email address.
• Update Profile: Update contact metadata or marketing preferences.
• Delete Profile: Execute GDPR Right to Erasure requests.

Webhooks (/v1/webhooks)¶

• Create Webhook Subscription: Register HTTPS endpoints for real-time lifecycle events (message.sent, message.delivered, message.seen, message.clicked, message.failed, message.expired).
• List Webhooks: Inspect existing webhook registrations.
• Rotate Webhook Secret: Immediately invalidate the existing secret and generate a new signing secret.
• Trigger Test Webhook: Dispatch a signed mock event payload to test your receiver implementation.

System (/v1/healthcheck)¶

• Authenticated Ping: Verify that your API credentials and signature headers are valid.

5. Standalone Code Examples¶

If you are developing outside Postman, the companion GitHub repository includes tested scripts for both Bearer and HMAC authentication:

• cURL:
• examples/curl/send_viber_bearer.sh — Standard dispatch via Bearer token
• examples/curl/send_viber_hmac.sh — HMAC-SHA256 signed dispatch
• examples/curl/create_profile.sh — Profile creation
• examples/curl/test_webhook.sh — Test webhook dispatch
• Python:
• examples/python/send_bearer.py — Python script using httpx and Bearer auth
• examples/python/send_hmac.py — Python script computing canonical HMAC-SHA256 signatures
• Node.js:
• examples/node/send_bearer.js — Node.js fetch script with Bearer auth
• examples/node/send_hmac.js — Node.js script using node:crypto for HMAC-SHA256 signing

6. Resources & Next Steps¶

• API Overview — Base URLs, error catalog, and API capabilities.
• API Authentication — Detailed explanation of Bearer vs. HMAC-SHA256 signing.
• Interactive Swagger UI — Explore the OpenAPI specification directly in your browser.
• Webhook Signatures — Verify incoming webhooks using HMAC-SHA256.