Skip to content
ISSA
Sign up

ISSA API

Read and write your leads, contacts and appointments from your own software, and get a message when something happens.

Authentication

Create a key in Settings, Developers, and send it as a Bearer token. Keys only have the permissions you gave them.

Authorization: Bearer issa_live_<prefix>_<secret>

Conventions

  • Each key can make 120 requests per minute. Beyond that you get error ISSA-4042 and a Retry-After header.
  • Lists use cursors: pass limit and the cursor you received as nextCursor.
  • Errors look like { "error": { "code": "ISSA-4040", "message": "…" } }.
  • Requests and responses are JSON in camelCase. Dates are ISO 8601.

Machine-readable description (OpenAPI 3.1): https://holaissa.com/v1/public/api/openapi.json

Leads

GET/leads

List leads

Needs the permission leads:read

Parameters
cursorquery · string
limitquery · integer
qquery · string
stageIdquery · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/leads
POST/leads

Create a lead

Needs the permission leads:write

Body
namerequiredstring
phonestring
intereststring
valueAmountnumber
valueCurrencystring
stageIdstring
ownerMemberIdstring
tagsstring[]
assistantIdstring

Responses: 201 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X POST -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/leads
GET/leads/{id}

Get a lead

Needs the permission leads:read

Parameters
idrequiredpath · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/leads/{id}
PATCH/leads/{id}

Update a lead

Needs the permission leads:write

Parameters
idrequiredpath · string
Body
namestring
intereststring
stageIdstring
ownerMemberIdstring | null
valueAmountnumber | null
valueCurrencystring
productIdstring | null
tagsstring[]
lostReasonstring

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X PATCH -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/leads/{id}

Contacts

GET/contacts

List contacts

Needs the permission leads:read

Parameters
cursorquery · string
limitquery · integer

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/contacts
GET/contacts/{id}

Get a contact

Needs the permission leads:read

Parameters
idrequiredpath · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/contacts/{id}

Appointments

GET/appointments

List appointments, soonest first

Needs the permission appointments:read

Parameters
cursorquery · string
limitquery · integer
fromquery · string
toquery · string
statusquery · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/appointments
POST/appointments

Create an appointment (it does not appear in an external calendar)

Needs the permission appointments:write

Body
contactIdrequiredstring
assistantIdstring
startAtrequiredstring
endAtrequiredstring
timezonestring
notesstring

Responses: 201 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X POST -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/appointments
GET/appointments/{id}

Get an appointment

Needs the permission appointments:read

Parameters
idrequiredpath · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/appointments/{id}
PATCH/appointments/{id}

Reschedule, cancel or annotate an appointment

Needs the permission appointments:write

Parameters
idrequiredpath · string
Body
startAtstring
endAtstring
status"booked" | "cancelled"
notesstring | null

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X PATCH -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/appointments/{id}

Patients

GET/patients

List patients (health module only)

Needs the permission patients:read

Parameters
cursorquery · string
limitquery · integer
qquery · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/patients
POST/patients

Create a patient (health module only)

Needs the permission patients:write

Body
fullNamerequiredstring
birthDatestring
sexstring
phonestring
emailstring
leadIdstring

Responses: 201 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X POST -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/patients
GET/patients/{id}

Get a patient (health module only)

Needs the permission patients:read

Parameters
idrequiredpath · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/patients/{id}
GET/patients/{id}/profile

Current clinical profile of a patient

Needs the permission patients:read

Parameters
idrequiredpath · string

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/patients/{id}/profile
GET/patients/{id}/notes

Signed clinical notes of a patient, newest first

Needs the permission patients:read

Parameters
idrequiredpath · string
cursorquery · string
limitquery · integer

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/patients/{id}/notes

Webhooks

GET/webhooks

List webhook endpoints

Needs the permission webhooks:manage

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/webhooks
POST/webhooks

Create a webhook endpoint (the signing secret is returned once)

Needs the permission webhooks:manage

Body
urlrequiredstring
eventsrequired"lead.created" | "lead.updated" | "appointment.created" | "appointment.updated" | "patient.created" | "note.signed" | "consent.signed"[]
descriptionstring

Responses: 201 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X POST -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/webhooks
PATCH/webhooks/{id}

Update a webhook endpoint

Needs the permission webhooks:manage

Parameters
idrequiredpath · string
Body
urlstring
events"lead.created" | "lead.updated" | "appointment.created" | "appointment.updated" | "patient.created" | "note.signed" | "consent.signed"[]
descriptionstring | null
activeboolean

Responses: 200 OK · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X PATCH -H "Authorization: Bearer $ISSA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{}' \
  https://holaissa.com/v1/public/api/webhooks/{id}
DELETE/webhooks/{id}

Delete a webhook endpoint

Needs the permission webhooks:manage

Parameters
idrequiredpath · string

Responses: 204 Done · 400 Invalid request (ISSA-0002) · 401 Missing, invalid, expired or revoked key (ISSA-4040) · 403 The key lacks the scope (ISSA-4041) · 404 Not found · 429 More than 120 requests a minute (ISSA-4042)

curl -X DELETE -H "Authorization: Bearer $ISSA_API_KEY" \
  https://holaissa.com/v1/public/api/webhooks/{id}

Webhooks

Add an https address in Settings, Developers and pick the events. ISSA sends a POST with a JSON body that has the ids of what changed; never free text from your records.

  • lead.created — apiDocs.webhooks.events.lead.created
  • lead.updated — apiDocs.webhooks.events.lead.updated
  • appointment.created — apiDocs.webhooks.events.appointment.created
  • appointment.updated — apiDocs.webhooks.events.appointment.updated

Every message carries X-ISSA-Signature: t=UNIX,v1=HEX. The signature is an HMAC-SHA256 of "t.body" with your endpoint secret. Check it and reject messages older than five minutes.

import { createHmac, timingSafeEqual } from 'node:crypto';

function verify(secret, rawBody, header) {
  const parts = Object.fromEntries(header.split(',').map((p) => p.split('=')));
  const expected = createHmac('sha256', secret).update(parts.t + '.' + rawBody).digest('hex');
  const fresh = Math.abs(Date.now() / 1000 - Number(parts.t)) < 300;
  return fresh && timingSafeEqual(Buffer.from(parts.v1, 'hex'), Buffer.from(expected, 'hex'));
}

Answer 2xx within 10 seconds. Otherwise ISSA retries 8 times over 24 hours with growing waits.

ISSA API documentation