Skip to main content
The Partner API lets a platform or ISV manage many businesses under one integration. Your parent account creates and controls a fleet of child accounts — typically one child per business or location — and mints scoped API keys for each. From there, every standard v2 endpoint (send, contacts, lists, schedules) works per child, and a set of partner-only endpoints let you provision children, read messages and billing across the whole portfolio, and receive signed delivery webhooks.
The Partner API is additive: a child account is a normal Trackly SMS account. Everything in the rest of this reference works inside a child exactly as it does for a standalone customer. The pages below cover only the partner-specific surface.

​
Base URL & authentication

All endpoints are served under https://api.tracklysms.com/api and authenticate with an API key in the X-Api-Key header (a Authorization: Bearer <key> fallback is also accepted).
Parent-level operations (creating children, issuing keys, cross-portfolio reads) use your parent key. Sends and other per-business operations use the child key you minted for that account.

​
What’s in Phase A

Accounts & hierarchy

The parent → child model, external IDs, pooled billing, and API-key issuance.

Messages read & reconciliation

List and fetch messages, and drive an incremental change feed off the updated_since watermark.

Usage & billing

Portfolio usage summaries, individual billing records, and per-period statements.

Webhook signing

Verify the HMAC-SHA256 signature on every delivery, reply, and opt-out event.

Idempotency

Safely retry POST requests with an Idempotency-Key without creating duplicates.

Sandbox & testing

Simulate sends and signed webhooks with a test key — no delivery, no billing.

​
Typical integration flow

  1. Provision a business. Create a child account with your own identifiers in externalIds, then mint a child API key.
  2. Configure webhooks. Register a webhook endpoint for the child and store its signing secret so you can verify signatures.
  3. Send. Use the child key with the standard send endpoints. Preflight first if you want to check eligibility and cost without sending.
  4. Reconcile. Poll messages and billing records with the updated_since / updatedSince watermark to keep your mirror in sync.

​
Test before you go live

Build against a sandbox key first: sends run every live gate (ownership, suppression, opt-in, BYOC) and return a simulated result — and a single sandbox send fires a real, signed webhook to your endpoint so you can prove your signature verification end-to-end before a single real message goes out.