curl cookbook

Set two variables once, then paste any line.

export MISSLESS_API_KEY="mls_live_3f9ac2e8b71d4c5f9e2a7b6c1d0e"
export B="https://social.missless.tel/v1"

Every call sends -H "Authorization: Bearer $MISSLESS_API_KEY"; JSON calls add -H "Content-Type: application/json". Ids below are examples.

Workspaces

# create (upsert on external_id)
curl -X POST $B/workspaces -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"external_id":"user_123","name":"Salon Nova","timezone":"Europe/Amsterdam"}'

# list, optionally by external_id
curl "$B/workspaces?external_id=user_123" -H "Authorization: Bearer $MISSLESS_API_KEY"

# get
curl $B/workspaces/ws7k2m9p4q1r8t3 -H "Authorization: Bearer $MISSLESS_API_KEY"

# patch
curl -X PATCH $B/workspaces/ws7k2m9p4q1r8t3 -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"timezone":"Europe/Brussels"}'

# delete (disconnects accounts, deletes posts, media, inbox)
curl -X DELETE $B/workspaces/ws7k2m9p4q1r8t3 -H "Authorization: Bearer $MISSLESS_API_KEY"

Workspace keys

# create (key shown once)
curl -X POST $B/workspaces/ws7k2m9p4q1r8t3/keys -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"label":"Claude Code on Nova laptop"}'

# list
curl $B/workspaces/ws7k2m9p4q1r8t3/keys -H "Authorization: Bearer $MISSLESS_API_KEY"

# revoke
curl -X DELETE $B/workspaces/ws7k2m9p4q1r8t3/keys/key4d6f8h2j4l6n -H "Authorization: Bearer $MISSLESS_API_KEY"

Connect links

curl -X POST $B/workspaces/ws7k2m9p4q1r8t3/connect-links -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"networks":["facebook","instagram"],"redirect_url":"https://app.example.com/settings/social","expires_in":3600}'

Accounts

# list in a workspace
curl $B/workspaces/ws7k2m9p4q1r8t3/accounts -H "Authorization: Bearer $MISSLESS_API_KEY"

# get
curl $B/accounts/acig4h2k5m7p9r1 -H "Authorization: Bearer $MISSLESS_API_KEY"

# stats
curl $B/accounts/acig4h2k5m7p9r1/stats -H "Authorization: Bearer $MISSLESS_API_KEY"

# refresh (re-validate the token)
curl -X POST $B/accounts/acig4h2k5m7p9r1/refresh -H "Authorization: Bearer $MISSLESS_API_KEY"

# disconnect
curl -X DELETE $B/accounts/acig4h2k5m7p9r1 -H "Authorization: Bearer $MISSLESS_API_KEY"

Media

# upload a file
curl -X POST $B/media -H "Authorization: Bearer $MISSLESS_API_KEY" -F "workspace=ws7k2m9p4q1r8t3" -F "alt=Fresh haircut" -F "file=@./friday.jpg"

# upload by URL
curl -X POST $B/media -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"workspace":"ws7k2m9p4q1r8t3","url":"https://cdn.example.com/cuts/friday.jpg","alt":"Fresh haircut"}'

# get (fresh signed url)
curl $B/media/med9x2c4v6b8n1m -H "Authorization: Bearer $MISSLESS_API_KEY"

# delete
curl -X DELETE $B/media/med9x2c4v6b8n1m -H "Authorization: Bearer $MISSLESS_API_KEY"

Posts

# publish now and wait for the result
curl -X POST "$B/posts?wait=true" -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"workspace":"ws7k2m9p4q1r8t3","caption":"Fresh cuts, Friday walk-ins welcome","media":["med9x2c4v6b8n1m"],"targets":["acig4h2k5m7p9r1","acfb8n2c4v6b1m3"],"external_ref":"acme:post:1234"}'

# schedule
curl -X POST $B/posts -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"workspace":"ws7k2m9p4q1r8t3","caption":"Weekend hours","media":["med9x2c4v6b8n1m"],"targets":["acig4h2k5m7p9r1"],"schedule_at":"2026-09-05T08:00:00Z"}'

# draft with a per-network caption and options
curl -X POST $B/posts -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"workspace":"ws7k2m9p4q1r8t3","caption":"Book at the link","media":["med9x2c4v6b8n1m"],"targets":[{"account":"acig4h2k5m7p9r1","caption":"Link in bio"},"acfb8n2c4v6b1m3"],"options":{"instagram":{"first_comment":"#salon"},"facebook":{"link":"https://salonnova.example/book"}},"status":"draft"}'

# list (calendar range)
curl "$B/posts?workspace=ws7k2m9p4q1r8t3&status=scheduled&from=2026-09-01T00:00:00Z&to=2026-09-30T23:59:59Z" -H "Authorization: Bearer $MISSLESS_API_KEY"

# list by your own id
curl "$B/posts?external_ref=acme:post:1234" -H "Authorization: Bearer $MISSLESS_API_KEY"

# get
curl $B/posts/pst5g7j9l2n4q6s -H "Authorization: Bearer $MISSLESS_API_KEY"

# patch (draft, scheduled or failed only)
curl -X PATCH $B/posts/pst5g7j9l2n4q6s -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"schedule_at":"2026-09-06T08:00:00Z"}'

# publish now (draft, scheduled or failed), wait for the result
curl -X POST "$B/posts/pst5g7j9l2n4q6s/publish?wait=true" -H "Authorization: Bearer $MISSLESS_API_KEY"

# cancel or delete
curl -X DELETE $B/posts/pst5g7j9l2n4q6s -H "Authorization: Bearer $MISSLESS_API_KEY"

Conversations

# unread open DMs in a workspace
curl "$B/conversations?workspace=ws7k2m9p4q1r8t3&kind=dm&status=open&unread=true" -H "Authorization: Bearer $MISSLESS_API_KEY"

# comments on one account
curl "$B/conversations?account=acig4h2k5m7p9r1&kind=comment" -H "Authorization: Bearer $MISSLESS_API_KEY"

# one conversation with its last 50 messages
curl $B/conversations/cnv2b4d6f8h1j3l -H "Authorization: Bearer $MISSLESS_API_KEY"

# older messages
curl "$B/conversations/cnv2b4d6f8h1j3l/messages?page=2&limit=50" -H "Authorization: Bearer $MISSLESS_API_KEY"

# reply (DM, or public comment reply on a comment conversation)
curl -X POST $B/conversations/cnv2b4d6f8h1j3l/messages -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"text":"Yes, Friday 15:00 is free. Shall I book it?"}'

# reply with quick replies
curl -X POST $B/conversations/cnv2b4d6f8h1j3l/messages -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"text":"Which slot?","quick_replies":[{"title":"Friday 15:00","payload":"slot:1500"},{"title":"Friday 16:30","payload":"slot:1630"}]}'

# private reply to a commenter (comment conversations only)
curl -X POST $B/conversations/cnv3c5e7g9i2k4m/private-reply -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"text":"Hi! A cut is 35 euro. Want me to book you in?"}'

# mark read
curl -X PATCH $B/conversations/cnv2b4d6f8h1j3l -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"unread":0}'

# close
curl -X PATCH $B/conversations/cnv2b4d6f8h1j3l -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"status":"closed"}'

Webhook and events

# register or replace (secret shown once)
curl -X PUT $B/webhook -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"url":"https://app.example.com/webhooks/missless","events":["*"]}'

# inspect
curl $B/webhook -H "Authorization: Bearer $MISSLESS_API_KEY"

# send a ping
curl -X POST $B/webhook/test -H "Authorization: Bearer $MISSLESS_API_KEY"

# remove
curl -X DELETE $B/webhook -H "Authorization: Bearer $MISSLESS_API_KEY"

# poll events
curl "$B/events?workspace=ws7k2m9p4q1r8t3&type=post.published&since=2026-08-25T00:00:00Z" -H "Authorization: Bearer $MISSLESS_API_KEY"

Embed sessions

curl -X POST $B/embed-sessions -H "Authorization: Bearer $MISSLESS_API_KEY" -H "Content-Type: application/json" -d '{"workspace":"ws7k2m9p4q1r8t3","surfaces":["composer","calendar","inbox","accounts"],"expires_in":3600,"theme":{"mode":"dark","accent":"#6d5efc","radius":"12px"},"locale":"en"}'

MCP

# list tools (workspace key)
curl -s $B/mcp -H "Authorization: Bearer mls_live_8a1d4f7c2e9b6a3d5f0c8e1b4a7d" -H "Content-Type: application/json" -H "Accept: application/json" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

# call a tool (partner key plus workspace header)
curl -s $B/mcp -H "Authorization: Bearer $MISSLESS_API_KEY" -H "X-MissLess-Workspace: ws7k2m9p4q1r8t3" -H "Content-Type: application/json" -H "Accept: application/json" -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"list_accounts","arguments":{}}}'

Not listed: the connect page’s own endpoints (/connect/:token, /connect/:token/meta/start, /connect/:token/accounts/:accountId, /oauth/meta/callback) and the widget’s /embed/* endpoints. They are token-authenticated for the hosted pages and are not meant to be called directly.