Swarmhit API (1.0.0)

https://app.swarmhit.com/api/v1

Every request must carry an API key as a bearer token:

Authorization: Bearer swh_live_xxxxxxxxxxxxxxxxxxxxxxxx

Create and revoke keys under Settings → API & Webhooks in the Swarmhit app. A key's full value is shown only once, at creation — store it securely. Each key is scoped to the workspace it was created in.

List endpoints accept limit (1–100, default 50) and offset query parameters, and return a paging object alongside data.

Errors use standard HTTP status codes with a JSON body:

{ "error": { "status": 404, "message": "Campaign not found." } }

Register webhook endpoints under Settings → API & Webhooks. Swarmhit POSTs a JSON payload to your URL when a subscribed event occurs. Every request includes these headers:

• X-Swarmhit-Event — the event type
• X-Swarmhit-Delivery — a unique delivery id; delivery is at-least-once, so use this to deduplicate
• X-Swarmhit-Signature — an HMAC-SHA256 hex digest of the raw request body, keyed by the endpoint's signing secret

Verify the signature before trusting a payload:

const crypto = require('crypto');
const expected = crypto
  .createHmac('sha256', SIGNING_SECRET)
  .update(rawRequestBody)
  .digest('hex');
const ok = crypto.timingSafeEqual(
  Buffer.from(expected),
  Buffer.from(req.headers['x-swarmhit-signature'] || ''),
);

Respond with any 2xx status to acknowledge receipt. Non-2xx responses are retried with exponential backoff; an endpoint that keeps failing is automatically disabled.

Service metadata.

Outreach campaigns and their leads.

The workspace address book.

LinkedIn conversations.