API Reference
Source-of-truth API docs generated from currently implemented routes.
Connect an AI agent to Laserreach
Create a scoped token for Claude Cowork, Codex, or your own agent client. The normal setup gives the agent Laserreach API access while hosted run control stays off.
Authentication Reality
Most assistant and ABM agent API operations accept JWTs, external-agent tokens, or route-supported API keys through the same header:
Authorization: Bearer <jwt_or_external_agent_token_or_api_key>
Organization-scoped ABM agent calls use:
X-Org-ID: <org_id>
What This Spec Covers
- Assistant APIs (CRUD, capabilities, messaging, automation lifecycle, knowledge operations)
- Plugin/tool APIs (`/plugins` create/list/update/run)
- ABM route catalog under `/api/abm/*` and adjacent `/api/*` platform surfaces
- ABM business-hours + LinkedIn safety controls (`/api/abm/business-hours`, `/api/abm/linkedin/accounts*`)
- Inbound integrations (HubSpot, Slack, Apollo webhooks, visitor tracking)
- Account/auth and user endpoints used by API clients (`/api_keys`, `/generate_api_key`, `/auth/*`, `/user/*`)
Not every endpoint accepts ordinary API keys. External-agent tokens are the supported self-serve path for Claude Cowork and other ABM agent clients.
External Agent Setup
- Open Organization Settings, then External Agents.
- Create a Claude Cowork token and copy the one-time token value.
- Give the agent the copied setup instructions, including the bearer token, org header, capabilities URL, read/list run URL, and HubSpot outreach sync URL.
Authorization: Bearer <external_agent_token> X-Org-ID: <org_id> Capabilities URL: https://api.laserreach.com/api/abm/agent/capabilities Run URL (read/list by default): https://api.laserreach.com/api/abm/agent-runs HubSpot Outreach Sync URL: https://api.laserreach.com/api/abm/crm/hubspot/outreach-sync Local MCP/webhook helper: https://github.com/tcmartin/laserreach-local-agent-mcp
Start from the capabilities endpoint. It returns the route groups available to the token, including memory, guidance, policies, workspace, schedules, recommendations, CRM sync, browser, content, ads, and intel.
Most local agents should not start or control Laserreach-hosted runs. Run creation, steering, cancellation, retry, and pruning require the explicit `agent-runs:control` scope because those calls can consume Laserreach execution resources.
Model-backed preparation, scoring, generation, and optimization use a separate hosted-ai:use scope. Leave it off when Claude, Codex, or another local model supplies reasoning and copy. Use laserreach_create_local_sequence to store local copy with use_ai=false.
An external agent can use its own model provider for planning and decisions, then call specific Laserreach APIs. Governed tokens follow human approval gates. Self-governed tokens skip those gates while Laserreach continues enforcing token scopes, org binding, account caps, sender checks, business hours, deduplication, kill switches, and audit logging.
Account settings, caps, connector credentials, kill switches, and governance remain user-managed.
For a non-technical walkthrough, use the External AI Agent Setup guide.
For Claude Desktop MCP, local Codex automation, signed webhooks, and cron jobs, use the open-source local agent helper.
Quick API-Key Flow
# 1) Create assistant
curl -X POST "https://api.laserreach.com/assistants" \
-H "Authorization: Bearer <api_key>" \
-H "Content-Type: application/json" \
-d '{"name":"Demo Assistant","prompt":"You are helpful.","model":"gpt-5.6-luna"}'
# 2) Create thread
curl -X POST "https://api.laserreach.com/assistants/<owner>/<bot_id>/threads" \
-H "Authorization: Bearer <api_key>" \
-H "Content-Type: application/json" \
-d '{"name":"First Thread"}'
# 3) Send message
curl -X POST "https://api.laserreach.com/assistants/<owner>/<bot_id>/threads/<thread_id>" \
-H "Authorization: Bearer <api_key>" \
-H "Content-Type: application/json" \
-d '{"message":"Hello"}'