Developers

The suggestion-box API, embedded once.

Pipe user ideas out of your product and into Wishbullet's public, vote-weighted, disputeable record — then pull structured events back into your own roadmap, ticketing, or support tools.

Quickstart

Every request is a Bearer-authenticated HTTPS call to /api/v1. Keys are created per entity in your dashboard settings.

curl -H "Authorization: Bearer wbl_live_..." \
  https://wishbullet.com/api/v1/entities/acme/ideas?limit=5

await fetch(
  "https://wishbullet.com/api/v1/entities/acme/ideas",
  {
    method: "POST",
    headers: {
      "Authorization": `Bearer ${process.env.WBL_KEY}`,
      "Content-Type": "application/json",
      "Idempotency-Key": crypto.randomUUID(),
    },
    body: JSON.stringify({
      title: "Add dark mode to the mobile app",
      body: "Reading in bed is painful without it…",
      tags: ["mobile", "accessibility"],
      external_user: { id: "u_1234", email: "jane@example.com" },
    }),
  }
);

Authentication

• API access is available on the Strategic plan. Each entity can create multiple keys (dev, staging, prod).
• Keys are prefixed with wbl_live_ and shown exactly once on creation. Store them in your secret manager.
• Send as Authorization: Bearer <key>.
• Each key is rate-limited at 120 requests/minute (60/minute for POST). When over-limit you get 429 with a Retry-After header.

Endpoints

Full parameters, response schemas, and a try-it-out playground live in the API reference.

Webhooks

Configure a single HTTPS endpoint per entity and subscribe to any subset of the event types below. Deliveries are signed with HMAC-SHA256 using a per-entity secret; verify them before trusting the payload.

Delivery is at least once: a non-2xx response or a timeout is retried after 5 minutes, 15 minutes, 1 hour, 6 hours and 24 hours (6 attempts in total). Every request carries an X-Wishlist-Delivery header that stays the same across retries, so you can safely ignore one you have already processed. Redirects are not followed.

Verifying signatures (Node)

import crypto from "node:crypto";

function verify(req: Request, rawBody: string, secret: string): boolean {
  const sig = req.headers.get("x-wishlist-signature") ?? "";
  const expected =
    "sha256=" + crypto.createHmac("sha256", secret)
      .update(rawBody)
      .digest("hex");
  // Timing-safe compare
  const a = Buffer.from(sig);
  const b = Buffer.from(expected);
  return a.length === b.length && crypto.timingSafeEqual(a, b);
}

Example payload: { event: "new_idea", idea_id, idea_title, data: {...}, timestamp }

Integrations

Every webhook consumer works today — Zapier, n8n, Make, or your own server. Native first-class connectors are landing next so you can wire Wishbullet into the tools your team already uses.

Generate a typed client

The API is documented in machine-readable OpenAPI 3.1. Point any generator at it to get a client in your language of choice.

npx openapi-typescript-codegen \
  --input https://wishbullet.com/api/v1/openapi.json \
  --output ./src/wishbullet