Included on every plan, including the trial

An API that can do everything the app can.

Scoped keys, idempotent writes, cursor pagination, signed webhooks and a generated OpenAPI document — described once in a typed route table so the docs cannot drift from the handlers.

Get an API key — free See the MCP server

No enterprise gate
Idempotency-Key on every write
HMAC-signed webhooks

At a glance

What you are working with

Endpoints

26Across 9 resource groups

Idempotent writes

13Replayed for 24 hours

Scopes

11Least privilege per key

Webhook events

8Signed and retried

Quickstart

Schedule a cross-platform post in one call

Create the post and its per-account targets together, and let the scheduler resolve the best time from that account's own engagement history.

curl

curl -X POST https://gongong.ai/api/v1/posts \
  -H "Authorization: Bearer $GONGONG_API_KEY" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: 2026-08-18-launch-note" \
  -d '{
    "content": "The calendar now publishes itself.",
    "targets": [
      { "socialAccountId": "acc_x_main" },
      { "socialAccountId": "acc_li_company" }
    ],
    "schedule": { "mode": "BEST_TIME" }
  }'

TypeScript

const response = await fetch('https://gongong.ai/api/v1/ai/repurpose', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.GONGONG_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    source: { url: 'https://example.com/blog/how-we-ship' },
    platforms: ['X', 'LINKEDIN', 'INSTAGRAM'],
  }),
});

const { angles } = await response.json();

Authentication

Hashed, workspace-scoped API keys

The public API never uses session cookies, which is why it has no CSRF surface. Send the key as a bearer token; it is stored hashed and can be revoked instantly.

Scopes

posts:read
posts:write
media:read
media:write
accounts:read
accounts:write
analytics:read
inbox:read
inbox:write
ai:generate
webhooks:manage

A key carries only the scopes you grant it. A call missing one is rejected with forbidden before any work happens.

Rules that matter

Keys are workspace-scoped — one key can never read another workspace.
A cross-tenant identifier returns 404, never 403; existence is not leaked.
Keys are shown once at creation and stored hashed thereafter.
Each key has its own rate limit, last-used timestamp and usage chart.
Revocation takes effect on the next request, not the next hour.

Reference

Every endpoint, grouped

The same table generates the OpenAPI document, the request validation and the MCP tools.

Posts

Create, schedule, publish and retry cross-platform posts.

Posts endpoints
Method	Path	What it does	Scopes
post	/v1/postsAccepts Idempotency-Key	Create a post	posts:write
get	/v1/posts	List posts	posts:read
get	/v1/posts/{id}	Get a post	posts:read
patch	/v1/posts/{id}Accepts Idempotency-Key	Update a post	posts:write
delete	/v1/posts/{id}Accepts Idempotency-Key	Delete a post	posts:write
post	/v1/posts/{id}/scheduleAccepts Idempotency-Key	Schedule a post	posts:write
post	/v1/posts/{id}/publishAccepts Idempotency-Key	Publish a post now	posts:write
post	/v1/posts/{id}/retryAccepts Idempotency-Key	Retry failed targets	posts:write

Accounts

Read connected social accounts and disconnect them.

Accounts endpoints
Method	Path	What it does	Scopes
get	/v1/accounts	List connected accounts	accounts:read
post	/v1/accounts/{id}/disconnectAccepts Idempotency-Key	Disconnect an account	accounts:write

Media

Presigned direct uploads and the workspace media library.

Media endpoints
Method	Path	What it does	Scopes
post	/v1/media/upload-urlAccepts Idempotency-Key	Create a presigned upload URL	media:write
get	/v1/media	List media assets	media:read

AI

Text, repurposing, image and video generation plus job polling.

AI endpoints
Method	Path	What it does	Scopes
post	/v1/ai/generateAccepts Idempotency-Key	Generate post drafts	ai:generate
post	/v1/ai/repurposeAccepts Idempotency-Key	Repurpose a source	ai:generate
post	/v1/ai/imageAccepts Idempotency-Key	Generate images	ai:generate, media:write
post	/v1/ai/videoAccepts Idempotency-Key	Generate a video	ai:generate, media:write
get	/v1/ai/jobs/{id}	Get an AI job	ai:generate

Analytics

Cross-account rollups, per-post drill-downs and best-time heatmaps.

Analytics endpoints
Method	Path	What it does	Scopes
get	/v1/analytics/overview	Analytics overview	analytics:read
get	/v1/analytics/posts/{id}	Per-post analytics	analytics:read
get	/v1/analytics/best-times	Best posting times	analytics:read

Inbox

Unified comments, mentions, reviews and DMs, and replies to them.

Inbox endpoints
Method	Path	What it does	Scopes
get	/v1/inbox	List engagements	inbox:read
post	/v1/inbox/{id}/replyAccepts Idempotency-Key	Reply to an engagement	inbox:write

Scheduling

Queues, rotation slots and next-free-slot resolution.

Scheduling endpoints
Method	Path	What it does	Scopes
get	/v1/queues	List queues	posts:read
post	/v1/schedule/next-slot	Resolve the next free slot	posts:read

Workspaces

Workspaces the calling API key can reach.

Workspaces endpoints
Method	Path	What it does	Scopes
get	/v1/workspaces	List workspaces	accounts:read

Usage

Plan entitlements, AI credit consumption and warning thresholds.

Usage endpoints
Method	Path	What it does	Scopes
get	/v1/usage	Get plan usage	analytics:read

Reliability

Idempotency, pagination and rate limits

The three things that decide whether an integration survives its first bad week.

Idempotency

Send Idempotency-Key on any write. The first response is stored and replayed for 24 hours, so a retry after a timeout cannot double-post.

Pagination

List routes are cursor-paginated. Pass the returned cursor back as cursor; an absent cursor means the end, not an empty page.

Rate limits

Limits are applied per API key and scale with the plan. A throttled call returns 429 rate_limited with a retry hint rather than a bare rejection.

Error shape

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key.",
    "details": { "retryAfterSeconds": 12 },
    "requestId": "req_9f2c1e"
  }
}

Error codes

bad_requestHTTP 400
unauthorizedHTTP 401
forbiddenHTTP 403
not_foundHTTP 404
conflictHTTP 409
rate_limitedHTTP 429
unprocessableHTTP 422
payment_requiredHTTP 402
internalHTTP 500
not_implementedHTTP 501

Webhooks

Events you can build on

Every delivery is HMAC-signed, retried on failure and recorded in a delivery log you can replay from.

post.publishedA target went live on its platform.
post.failedA target exhausted its retries or hit a permanent error.
comment.receivedA new comment, reply, mention or review landed in the inbox.
dm.receivedA new direct message landed in the inbox.
approval.requestedA post was sent for review.
analytics.weekly_readyThe weekly analytics rollup and learnings finished.
account.disconnectedA social account lost its credentials or was disconnected.
ai.job.completedA queued generation job reached a terminal state.

Endpoints are configured per workspace

Add an endpoint in Settings, pick the events, and use the test button to fire a signed sample before you write a single handler. Failed deliveries retry with backoff and stay in the log.

Get a key before you write a line of code

The trial includes the full API and MCP surface for fourteen days, with no card and no sales call.

Create a free account Read the MCP docs

No credit card · Cancel anytime · Every plan includes the API and the MCP server