API Access

dialnote has a public API so you can read your call data from your own apps, scripts, or an AI assistant. You create a scoped key, send it as a bearer token, and pull contacts, conversations, call logs, and more. If you'd rather push events out of dialnote instead of pulling them in, look at Webhooks or Zapier for the write-side automation.

This guide covers creating API keys and the read-only key option. To connect an AI assistant, see Connect an AI Assistant over MCP.

Creating an API Key#

Go to Settings → API Keys and click Create API Key. Give the key a name you'll recognize later (e.g. "Reporting script" or "Claude Desktop"), then create it. API access is included on the Business and Pro plans, and only an org owner or admin can create, view, or revoke keys.

The full key is shown once, at creation. It starts with dn_live_. Copy it and store it somewhere safe—a password manager or your app's secrets store. dialnote can't show it to you again, so if you lose it you'll have to create a new one.

A few things worth knowing:

• Keys are org-scoped — a key works for your whole organization, not a single user.
• You can have up to 25 active keys per org.
• You can revoke any key anytime from the same screen. A revoked key stops working right away.

Authenticating#

Every public endpoint lives under one base URL:

https://api.dialnote.com/api/v1/public

Send the key as a bearer token on every request. The shorthand paths later in this guide (like /contacts or /messages) are relative to that base:

curl https://api.dialnote.com/api/v1/public/contacts \
  -H "Authorization: Bearer dn_live_your_key_here"

That's it—no other setup. The API returns JSON.

Read-Only Keys#

When you create a key, you can turn on the Read-only key toggle in the Create API Key modal. A read-only key can read your data but can't change anything.

Reads work as normal—listing and fetching contacts, conversations, call logs, messages, recordings, and notes all return 200. Writes are blocked. Anything that would create, update, delete, or send returns:

HTTP 403
{
  "code": "INSUFFICIENT_PERMISSIONS",
  "message": "This API key is read-only and cannot perform write operations. Create a full-access key to make changes.",
  "status": "error"
}

The error code is in the code field, not error. So POST /messages, POST /contacts, PUT /contacts/:id, and DELETE /contacts/:id all get a 403 on a read-only key. Only a full-access key can run those. (Those paths are relative to the base URL above—the full path for the first is https://api.dialnote.com/api/v1/public/messages.)

Once created, a read-only key shows a Read-only badge—both on the created-key screen and in the key list—so you can tell at a glance which keys are scoped.

When to use read-only#

Reach for a read-only key any time a key leaves your own trusted code—third-party software, a partner's app, or an AI agent. It caps the blast radius if the key ever leaks. A leaked full-access key could send messages on your dime or change and delete your contacts; a leaked read-only key can only read. For anything that just needs to look at your data, read-only is the safer default.

What a read-only key can access#

The rule is simple: every GET is allowed, every POST, PUT, PATCH, and DELETE is blocked. There's no per-resource allowlist, so a read-only key reaches everything below.

Connect an AI Assistant#

Want an AI assistant to read your dialnote data directly, instead of pulling it through your own code? Add the hosted dialnote MCP server as a connector and sign in with your dialnote account, or use a read-only key for clients that can't sign in. See Connect an AI Assistant over MCP for the full setup.

Next Steps#

• Connect an AI assistant over MCP by signing in with your dialnote account
• Set up webhooks to push call events out to your systems
• Connect Zapier for no-code automation across 5,000+ apps
• Browse all integrations

The full list of tools dialnote connects to is on the integrations page.