# SambungAPI SambungAPI is the one connection for the tools your team's bots use: WhatsApp, Gmail, Google Calendar, and more, with a simple API for developers. Metatech ID (PT Trifidia Cipta Korpora) builds and operates it. It connects organizations and projects to provider accounts, exposes a discoverable tool catalog, and runs its tools through one consistent API. After sign-in, the SambungAPI console is at https://sabi.metatech.id/app. ## When to use SambungAPI Use SambungAPI when an agent or application needs to call external tools for an application user and should not implement every provider's OAuth flow, credential lifecycle, account connection, and request format itself. It is a good fit when work needs organization and project boundaries, connected-account management, provider authorization, tool discovery, auditable live actions, or a small public health/readiness surface. It is not a general-purpose web search engine, an LLM provider, or a replacement for the provider's own API terms and permissions. ## Discovery and documentation - OpenAPI document: https://sabi.metatech.id/openapi.json - Control-plane surface contract: https://sabi.metatech.id/v1/specs/control - Tools surface contract: https://sabi.metatech.id/v1/specs/tools - Tool catalog: https://sabi.metatech.id/v1/specs/catalog — read this before you hold a key: it needs no credential, and it lists every toolkit and every tool with its input schema. An execute needs the `ak_*` key that "How agents should call it" below describes. - Messaging surface contract: https://sabi.metatech.id/v1/specs/messaging - Vocabulary contract: https://sabi.metatech.id/v1/specs/vocabulary - Documentation index: https://sabi.metatech.id/docs — read this when you do not yet know which guide you need: it lists every page below with one line on when to read it, and like every page in the section it has a Markdown answer: send `Accept: text/markdown`, or read its Markdown address, https://sabi.metatech.id/docs.md. - API guide: https://sabi.metatech.id/docs/api — read this to make the first call: where to mint a key, how to connect an application user's account before the first execute (an auth config, a connect link, the consent and the `ACTIVE` status), the tool-execute path and its `{data, meta}` envelope, the error envelope, the WhatsApp gateway send, and where the execution log is. - MCP guide: https://sabi.metatech.id/docs/mcp — read this when an agent should reach the tools through MCP: the endpoint URL, the credential header, the application user in the URL, the toolkits and tools parameters that narrow the list, the connect step for a missing account, what a call costs, and examples for Claude Code, Cursor and the Anthropic and OpenAI APIs. - Tool catalog page: https://sabi.metatech.id/docs/tools — read this to plan a call before you sign up: each toolkit, whether this deployment offers it and how it connects, and each tool of an offered toolkit with a table of its arguments. It is the catalog of `/v1/specs/catalog` as a page. - Composio SDK guide: https://sabi.metatech.id/docs/composio — read this when the caller already uses the Composio SDK: it names the three mismatches that stop `tools.execute` reaching this server, and the plain-HTTP request to send instead. - Migration guide: https://sabi.metatech.id/docs/migrate-whatsapp — read this when a business already sends WhatsApp through another provider and wants the same business phone number on SambungAPI: under Meta's new account model the business shares the number rather than moving it, what has to be rebuilt here, a six-step runbook that ends with removing the source provider, and one block per source provider. - Try path: https://sabi.metatech.id/docs/try-whatsapp — read this when a developer wants a first WhatsApp message before a production WhatsApp Business Account exists: a nine-step walk on Meta's test account, from the Meta app to a signed delivery at the developer's own endpoint, with the limits of the test assets and what the walk does not prove. - Why page: https://sabi.metatech.id/docs/why — read this when weighing SambungAPI against calling Meta's WhatsApp Cloud API directly: it lists the machinery around a WhatsApp send that SambungAPI owns, what a direct integration builds and maintains instead, and the boundary Meta keeps over acceptance, delivery and billing. - Public homepage: https://sabi.metatech.id/ - Business guide: https://sabi.metatech.id/business — read this when a business owner with no developer asks what SambungAPI does for a business, what needs a developer today, and what it costs. - Glossary: https://sabi.metatech.id/glossary — read this when a page uses a product word that you do not know, such as organization, project, connected account or toolkit: it says in plain language what each one means, and the documentation pages link each word to its entry at first use. - Privacy policy: https://sabi.metatech.id/privacy - Terms of service: https://sabi.metatech.id/terms - Markdown addresses: add `.md` to the address of the homepage (https://sabi.metatech.id/index.md), the Business guide, the Glossary, each documentation page and the two legal pages, for example https://sabi.metatech.id/docs/api.md. A Markdown address answers Markdown to every request, so read it when your fetch tool cannot set the `Accept` header. ## How agents should call it Start by reading `/openapi.json` and the relevant bounded contract under `/v1/specs/`. Read `/v1/specs/catalog` to choose a tool and to write its `arguments`. Use `/health` for liveness and `/ready` for readiness. Control-plane administration uses a personal bearer token with the `cpt_*` family. A person creates a cpt_* token in the console's account menu, under Control-plane tokens. A project key is the credential your software uses to run tools for one project. Project-scoped tool work uses an `ak_*` project key as `Authorization: Bearer`; the `x-api-key` header is also accepted. Every key of an organization is one kind of key, the API key, `ak_*` and `ww_*` alike: the organization owns it, and it has a Tools part (the tools of one project), a channel part (the channel API and the WhatsApp gateway), or both. A key without the part a route needs gets `403 Auth_KeyOutOfReach`, `GET /v1/key` answers the parts of the calling key, and `POST /v1/control/organizations/{organization_id}/keys` mints one key with both parts. The tool call is `POST /v1/tools/{slug}/execute`, `GET /v1/tools` lists the tools, and `GET /v1/tools/{slug}` reads one tool. An MCP client adds https://sabi.metatech.id/mcp with a project key. Keep credential families separate, scope requests to the intended organization and project, and never place secrets in URLs or logs. ## Get a project key A person signs in to the console, and an agent gets its project key from a person. Use one of two ways: - Key request: send `POST https://sabi.metatech.id/v1/control/key_requests` with `{"client_name": ""}`. To name the toolkits that you need, add "toolkits", for example ["gmail"]: after Allow, the person can connect their own account of each of them in the chosen project on the same page. Give the person the `verification_uri_complete` link, and tell them the `user_code`. Every `interval` seconds, send `POST https://sabi.metatech.id/v1/control/key_requests/token` with `{"device_code": ""}`. A `202` means the person has not answered yet. A `200` carries the project key in `data.api_key`, one time. The request expires after 10 minutes. - Console: a person mints the key at https://sabi.metatech.id/app/projects/{project_id}/keys and gives it to you. Before the first call of a tool, a connected account of its toolkit must exist. When the person connected a toolkit on the key request page, run its tools with the user id data.key.created_by from the answer of the poll, in the execute body or as user_id in the MCP URL. Else the application user connects an account: see the connect step in https://sabi.metatech.id/docs/api. An agent with no project key can ask a person for one with a Key request, or start machine sign-in and ask the person to approve one link. A Key request returns one project key. Machine sign-in returns a Control-plane token for the approving person; the agent can use it to mint project keys. Each Control-plane token expires after 30 days, but the agent can mint another one. Project keys do not expire by default. A Control-plane token cannot call Tools or /mcp; the agent still needs a project key and a Connected account. Machine sign-in starts with `POST https://sabi.metatech.id/v1/control/machine_sign_ins` and `{"client_name": ""}`, and its poll is `POST https://sabi.metatech.id/v1/control/machine_sign_ins/token` with `{"device_code": ""}`: a `200` carries the token in `data.personal_token`, one time. ## Product concepts An organization is the tenant boundary. A project is an isolated environment inside an organization. Connected accounts represent provider authorization available to a project. Tools are named actions that a project can discover and execute. SambungAPI stores the connection needed to call the provider while keeping control-plane administration, project credentials, and execution records explicit. Provider availability depends on the deployment configuration and the provider's own permissions. ## Canonical host Use https://sabi.metatech.id as the canonical public host. For a machine-readable overview, prefer this file and `/openapi.json` over scraping the JavaScript application bundle.