The API console lets you try every request in the API reference from your browser, with your own API application. The console checks each request against the docs before sending it, and checks the response when it arrives. You can copy any request as code for curl, Node, Python, PHP or C#. Every operation in the reference has a Try it link that opens it in the console.
Live data#
There is one environment, so the console works on your organisation's real
data, as your own systems would. Reads (GET) are sent straight away.
Requests that change data (POST, PATCH or PUT) ask you to confirm
first, and say what they'll do. Requests under
Checkout can take a real payment or put
a real policy on cover, so they show a stronger warning. Only send them for a
test customer you've set up for this.
Getting a token while signed in#
If you're signed in as an owner or manager of an organisation, pick one of its API applications from the list. The console shows the application's scopes. Tick the ones to request, or none for all of them, and press Get a token. Because you're signed in, Subcontext issues the console a token for that application without the client secret.
These tokens last an hour, and end when you sign out. Press Get a new token at any time. To follow the same steps your own code will take, press Use a client secret instead and enter the secret, as below.
Getting a token with a client secret#
- Enter your API application's client id and client secret (an application's secret is shown once, when it's created or rotated).
- Tick the scopes to request, or none for all the application has. The scopes needed by the request you're viewing are marked.
- Press Get a token. Your browser requests a token from
https://subcontext.com/oauth/token, as in Get a token, and shows when it expires. Get a new one at any time.
The secret and the token are held only in the open page. They're never saved in your browser or by Subcontext, never put in a URL, and never written to our logs. They're cleared when you leave the page or press Forget the secret and token. A token issued with the secret lasts until it expires, like any other.
Server-only and browser applications#
The console sends requests to the API as your server would, with no Origin
header, so a server-only application's token works for every request. A
browser application only accepts requests from its own websites. Enter one of
its allowed origins in Send as a website and the request is sent as that
website. Requests marked Server-only applications reject a browser
application's token, as they do from your own code. Server-only or browser
explains the difference.
Checks before and after#
- Before: as you fill in a request, the console checks required parameters, each value's type, and the JSON body against the request's schema. Problems show next to the field they relate to. You can still send a request that doesn't match, to see how the API responds.
- After: the console shows the response's status, how long it took, its headers and body, and whether the body matches the docs for that status (or how it differs).
Code for every request#
The Code panel shows the request you're building, updated as you type, in
curl, Node (fetch), Python (requests), PHP (curl) and C# (HttpClient).
The code reads your token from the SUBCONTEXT_TOKEN environment variable.
Tick Put my token in to include the token in the code instead, and don't
share that code.
Guided flows#
A guided flow runs a few requests in order, filling each one in from the earlier responses. You can change any value before you send each step.
- Explore your products: list your products, view one, list its journeys and read a journey's questions. Read only.
- Send a lead and follow it: send a lead, read what happened to it, find
the lead and list its events. Needs a server-only application with the
crmscope. It creates a real lead, so use a test person. - Start a quote: start an application, save answers and get a price. The flow stops there. Accepting a quote, taking payment and setting up the policy are left to you.