Wave API

Quick Start

curl -H "Authorization: Bearer wave_api_xxx..." \
  https://api.wave.co/v1/sessions

{
  "sessions": [
    {
      "id": "abc123",
      "title": "Weekly Standup",
      "timestamp": "2025-01-20T10:00:00Z",
      "duration_seconds": 1800,
      "type": "meeting",
      "platform": "zoom"
    }
  ],
  "next_cursor": "2025-01-19T09:00:00Z",
  "has_more": true
}

Authentication

All API requests must be authenticated using a Bearer token in the Authorization header.

Creating a Token

1. Go to app.wave.co/settings/integrations/api
2. Click "Create Token" and give it a descriptive name
3. Select the permissions (scopes) your application needs
4. Copy the token immediately — it will only be shown once

Scopes

Tokens are granted specific permissions that control what data they can access. Request only the scopes your application actually needs.

Token Security

• Tokens are only shown once when created — store them securely
• Tokens expire after 1 year but can be revoked at any time
• Use environment variables to store tokens, never commit them to code
• Create separate tokens for different applications
• Revoke tokens immediately if they may have been compromised
• Grant only the scopes your application needs (principle of least privilege)

Error Responses

Authentication errors return appropriate HTTP status codes:

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "invalid_token",
    "message": "Token is invalid, expired, or revoked"
  }
}

{
  "error": {
    "code": "insufficient_scope",
    "message": "This endpoint requires the 'sessions:write' scope"
  }
}

API Endpoints

Quick reference for all Wave API endpoints. For request/response schemas and a built-in request builder, see the Interactive API Reference.

All endpoints require a Bearer token. Base URL: https://api.wave.co

Sessions

Transcripts

Media

Account

Webhooks

Register HTTPS endpoints to receive real-time notifications when sessions are completed, updated, or deleted. Payloads are signed with HMAC-SHA256 for verification.

Webhook Events

Signature Verification

Each delivery includes these headers for verification:

To verify: compute HMAC-SHA256(secret, "webhookId.timestamp.body") and compare with the signature header.

Error Codes

All errors return a consistent JSON structure:

{
  "error": {
    "code": "error_code",
    "message": "Human-readable description"
  }
}

Rate Limits

• 60 requests per minute per token
• 1,000 requests per day per token

Rate limit info is included in every response:

X-RateLimit-Limit: 60
X-RateLimit-Remaining: 58
X-RateLimit-Reset: 1706000000

API Reference

The full OpenAPI 3.1 specification is available at:

Use it to generate client libraries, import into Postman, or validate requests.