generated: '2026-08-13' method: searched source: >- https://developer-platform.vibes.com/reference/technical-details, https://developer-platform.vibes.com/reference/versions-compatibility, https://developer-platform.vibes.com/reference/callbacks, https://developer-platform.vibes.com/docs/client-certificate-authentication-for-vibes-apis, openapi/vibes-platform-api-openapi.json provider: Vibes Platform providerId: vibes-platform description: >- Cross-cutting runtime semantics for the Vibes Platform API — what a client (or an agent) has to get right on every call, independent of which resource it is touching. Read from Vibes' own Technical Details and Versions & Compatibility pages and cross-checked against the published OpenAPI (48 paths / 75 operations). media_type: application/json required_headers: - name: Content-Type value: application/json required: true - name: X-API-Version value: '2' required: true note: >- Version selector, not a content negotiator. Declared as a parameter on 73 of the 75 published operations. One operation declares it in the wrong case (X-API-VERSION) — a real inconsistency in the published spec, not a transcription error. - name: Authorization value: 'Basic ' required: true authentication: style: HTTP Basic scheme: basic transport: header scope: per company account additional: - type: mutualTLS name: Client certificate authentication optional: true docs: https://developer-platform.vibes.com/docs/client-certificate-authentication-for-vibes-apis note: Offered as an extra layer on top of Basic, not as a replacement. - type: oauth2 name: OAuth 2.0 client credentials applies_to: Vibes RCS Business Messaging API only token_url: https://vibes-rbm-prd.auth.us-west-2.amazoncognito.com/oauth2/token scope: https://rbm.vibes.com/rbm.agents regional_note: >- Credentials are NOT portable between regions — Vibes states usernames must differ between the EU and US instances. An agent holding one credential set cannot fail over to the other host. cross_ref: authentication/vibes-platform-authentication.yml idempotency: supported: true header: Idempotency-Key required_on: - POST /companies/{company_key}/campaigns/wallet/{token}/locations/bulk semantics: >- "Repeating a request with the same key returns the original result without inserting duplicates." scope: per request retention: not published coverage: >- HONEST SCOPE: exactly ONE of 75 published operations declares Idempotency-Key, and on that one it is REQUIRED rather than optional. Every other unsafe write — create a broadcast, add a person, add an acquisition participant, create an event, issue an incentive code — has no idempotency key at all, and Vibes separately warns that callbacks may be delivered more than once. So retries are safe on bulk store-location writes and unsafe everywhere else. source: https://developer-platform.vibes.com/reference/post_companies-company-key-campaigns-wallet-token-locations-bulk pagination: style: page-number params: page: page page_size: page_size response_fields: not published default_page_size: not published max_page_size: not published coverage: >- Declared on GET /companies/{company_key}/campaigns/wallet/{token}/locations only. Collection endpoints elsewhere (broadcasts, persons, subscription lists, incentive pools, wallet items, wallet messages) publish no paging parameters, so an agent cannot tell whether a list response is complete. filtering: supported: true style: query parameters and first-class field filters docs: https://developer-platform.vibes.com/reference/first-class-fields note: >- Vibes exposes typed filter objects in the spec (first-class-filters, filters-string, filters-number, wallet-filters) for querying persons and wallet items by first-class field. expansion: supported: false note: No field expansion or sparse-fieldset mechanism is documented. request_tracing: request_id_header: not published note: >- No correlation/request-id header is documented on requests or responses, and the OpenAPI declares no response headers on any of the 75 operations. There is no published way to quote a request back to Vibes support. versioning: style: header header: X-API-Version current: '2' versions: - version: '1' status: default note: >- Does not accept E.164 phone numbers, so it cannot be used for international sends. Passing an E.164 MDN returns an error; querying a person with a non-E.164 MDN returns `countrynotsupported`. - version: '2' status: current note: Adds E.164 international phone number support across Acquisition Campaign, Person, Subscription List and Event APIs. trap: >- Version 1 is still the DEFAULT. A client that omits X-API-Version silently gets the version that cannot send internationally. forward_compatibility: >- Vibes publishes explicit forward-compatibility guidance: bind only the fields you use, follow the REST URLs returned in payloads rather than hard-coding paths, avoid strict binding/codegen that throws on unknown fields, and test with extra unknown elements present. source: https://developer-platform.vibes.com/reference/versions-compatibility errors: format: vendor rfc9457: false media_type: application/json envelope: '{"errors": [{"message": "...", "code": 0}]}' shape: >- Any 4XX returns a JSON body with an `errors` array; each element carries a human `message` and a numeric `code`. Multiple validation failures are returned together in one array rather than one at a time. cross_ref: errors/vibes-platform-problem-types.yml source: https://developer-platform.vibes.com/reference/technical-details rate_limiting: signalling: status-code-only status: 429 headers: none published cross_ref: rate-limits/vibes-platform-rate-limits.yml hosts: regions: - region: US url: https://public-api.vibescm.com - region: EU url: https://public-api.eu.vibes.com/ note: >- Region is selected by host, not by header or path. The published spec carries a trailing slash on the EU server URL and none on the US one. egress_allowlist: documented: true source: https://developer-platform.vibes.com/reference/callbacks#/originating-ip-address-ranges us: - 35.155.139.143 - 52.32.61.199 - 35.161.244.84 - 18.205.120.48 - 52.22.43.57 - 18.232.9.131 eu: - 34.243.232.57 - 52.48.241.82 - 34.249.188.130 - 54.247.36.51 - 34.253.250.65 - 54.217.181.160 note: Vibes publishes the source IP ranges its callbacks originate from so receivers can allowlist them. callbacks: delivery: at-least-once note: >- Vibes states an event may be delivered more than once in error scenarios and that receivers MUST handle duplicates. Retry behaviour is driven by the receiver's status code: 2XX = accepted, 4XX = permanent failure (no retry, straight to failure queue), 3XX/5XX = transient (retried on the configured scheme, then failure queue). Registration is capped at 50 endpoint URLs, one registration per callback type per company. cross_ref: asyncapi/vibes-platform-webhooks.yml privacy: message_redaction: supported: true granularity: per short code note: >- Redaction keeps message bodies and phone numbers out of Vibes transaction logs. Vibes itself advises against enabling it where TCPA compliance may need to be proven later. source: https://developer-platform.vibes.com/reference/technical-details operation_ids: present: false note: >- The published Vibes Platform OpenAPI declares NO operationId on any of its 75 operations. Every artifact in this repo that needs to name an operation therefore addresses it as `METHOD /path`. Adding operationIds is the single cheapest change Vibes could make for SDK generation and agent tooling.