AskSiya is the phone layer: Siya answers the call and turns it into a structured record. The REST API and outbound webhooks are how that record reaches every other system you run. There are no native POS or PMS connectors yet, for anyone, and this is the supported way to automate today.
You do not need to be a developer. If you can paste a URL into a form, the Zapier route covers most of it, and the integrations hub says where each product stands.
Keys are created on the Integrations page of your AskSiya dashboard. Make one, copy it into wherever you keep secrets, and you can send your first request.
https://platform.asksiya.com/api/v1Authorization: Bearer <key>, on every request.Treat it like a password. It reads your orders, your bookings and your call records, so keep it out of front-end JavaScript, out of your repo and out of email. If one gets loose, delete it on the Integrations page and create a replacement.
Everything Siya captures is readable. All paths hang off the base URL.
| Endpoint | What it returns |
|---|---|
me | The account the key belongs to. The cheapest check that a key works. |
orders | The food orders on your order board, exactly as Siya took them. |
bookings | Room bookings taken against your inventory, with the caller's confirmation code. |
appointments | Appointments Siya booked, including ones later cancelled. |
tickets | Maintenance and service requests raised by the ticket desk. |
calls | Completed calls with their outcome and summary, whatever the result. Turn-by-turn transcript text stays in the dashboard and is not returned by the API. |
The five list endpoints (everything except me) take the same three query parameters:
since is a timestamp, and you get back only records after it. This turns a full export into an incremental sync.limit is your page size.cursor is the pagination token. Pass the one from the previous response to fetch the next page, until a page comes back without one.Pulling new orders since 6 p.m.:
curl -s \
"https://platform.asksiya.com/api/v1/orders?since=2026-07-26T18:00:00Z&limit=50" \
-H "Authorization: Bearer $ASKSIYA_API_KEY"Poll politely. Store the timestamp of the newest record you hold, pass it back as since, and leave a minute between runs. Webhooks beat any interval you can set.
Give AskSiya a URL on the Integrations page and we POST to it the moment something happens. Six events fire today.
| Event | Fires when | Typical use |
|---|---|---|
order.created | Siya finishes an order and it hits the board. | Print a makeline ticket, or push it to your counter. |
booking.created | A room booking is confirmed with a code. | Mirror the stay into a PMS worksheet or the front desk channel. |
appointment.created | An appointment is booked on a call. | Add the slot to a shared calendar and open a task. |
appointment.cancelled | A booked appointment is cancelled. | Release the slot and text whoever held it. |
ticket.created | The ticket desk raises a request. | Open a work order, or page the on-call tech. |
call.completed | A call ends and its summary and outcome are ready. | File it on a CRM record, or feed a daily digest. |
X-AskSiya-Event tells you which of the six this is, so one endpoint can handle all six.X-AskSiya-Delivery is a unique id for the delivery. Keep the ones you have processed and ignore repeats: your dedupe key.X-AskSiya-Signature is a sha256 HMAC of the raw request body, keyed with your webhook secret.A webhook URL is public. Anyone who learns it can POST to it.
Compute a sha256 HMAC of the raw request body bytes, keyed with your webhook secret, and compare it to X-AskSiya-Signature in constant time. Read the raw body first: if your framework parses the JSON and hands you a dictionary, re-serializing it will not reproduce the bytes we signed, and every check fails.
Python:
import hashlib
import hmac
def verify(raw_body: bytes, signature: str, secret: str) -> bool:
expected = hmac.new(
secret.encode("utf-8"),
raw_body,
hashlib.sha256,
).hexdigest()
return hmac.compare_digest(expected, signature)Node.js:
const crypto = require("crypto");
function verify(rawBody, signature, secret) {
const expected = crypto
.createHmac("sha256", secret)
.update(rawBody)
.digest("hex");
const a = Buffer.from(expected, "utf8");
const b = Buffer.from(signature || "", "utf8");
return a.length === b.length && crypto.timingSafeEqual(a, b);
}In Express that means express.raw() on the webhook route, not express.json(). In Flask, request.get_data(), not request.get_json(). Same rule in every stack: hash the bytes that arrived, and parse the JSON once the check passes.
Anything that is not a 2xx response, and anything that times out, is retried on a fixed backoff: 1 minute, 5 minutes, 15 minutes, 1 hour, 6 hours, 24 hours. After that the delivery is given up on. It is a bit over 31 hours of cover, enough to survive a bad deploy or a quiet Sunday.
X-AskSiya-Delivery against what you have handled and drop repeats.If every retry is exhausted nothing is lost: backfill with the list endpoints and a since parameter covering the outage.
Little of this needs a real application. Most of it is one small script, or one Zap. The Zapier route is a Catch Hook and a field mapping.
The API is on every plan, from Starter at $29/mo for 150 included minutes. Your plan decides which records exist to read: the order taking, room booking, table reservations and ticket desk add-ons each create their own objects. All four are free on Pro, and free on every plan during early access. Full ladder on the pricing page.
If your line is not forwarded yet, no endpoint will have anything in it. Start with a carrier guide such as forwarding an AT&T line and make a test call first. Stuck on something this page does not cover? Send us the details.
Yes. API access and outbound webhooks are on every plan, including Starter at $29/mo for 150 included minutes. There is no developer tier and no per-request charge.
What your plan changes is which records exist to read. The restaurant order taking add-on (+$49/mo) creates orders, hotel room booking (+$49/mo) creates bookings, table reservations (+$29/mo) and the property ticket desk (+$29/mo) create their own records. Calls and transcripts are there on every plan. All four add-ons are free on Pro and free on every plan during early access. See the pricing page.
The delivery is retried on a fixed backoff: 1 minute, 5 minutes, 15 minutes, 1 hour, 6 hours, then 24 hours. If the last attempt still fails, that delivery is given up on. The schedule gives you a bit over 31 hours to notice and fix the problem.
Nothing is lost even if every retry is exhausted. Call the list endpoints with a since parameter covering the outage window and backfill whatever you missed.
Yes, and you should do it without downtime. Create a second key on the Integrations page in your dashboard, switch your integration over to it, confirm the new key is serving traffic, then delete the old one. Nothing forces you to run a single key.
Rotate immediately if a key ever lands somewhere it should not: a shared document, a client-side bundle, a screenshot. A key carries the same access your account has, so treat a leak as you would a leaked password.
We do not publish a hard rate limit today, which is exactly why you should be conservative. Treat once a minute per endpoint as a sensible ceiling, use the since parameter so each run only asks for new records, and back off if a request fails rather than retrying in a tight loop.
Better still, do not poll. Webhooks push each order, booking, appointment, ticket and completed call to you within seconds of the event, which is faster than any polling interval and far less work for both sides. Polling is best kept as a backfill tool.