HIT Communications API and developer resources

• Find out what HIT Communications offers — Microsoft Teams telephony, cloud PBX and contact center, omnichannel WhatsApp service, multi-operator connectivity and SD-WAN, cybersecurity, managed IT and voice traffic — and in which countries (Brazil, Colombia, Mexico, Panama, Spain, Portugal, United States).
• Read or summarise HIT Communications blog articles on connectivity, security, telephony and technology, in English, Spanish or Portuguese.
• Prepare a sales enquiry for a person who wants a demo or proposal, validate it with the dry-run sandbox, and hand it to them to send from the contact page or WhatsApp.
• Do not use it to obtain prices: HIT Communications does not publish prices; proposals are made after a call with the sales team.

The contract is versioned under /api/v1. List the latest security articles:

curl -sS "https://www.hitcommunications.com/api/v1/blog/posts?locale=en-us&category=Security"

Every page of the website is also available as Markdown when you ask for it:

curl -sS -H "Accept: text/markdown" https://www.hitcommunications.com/en-us/solutions/cybersecurity

Every write endpoint accepts dry_run=true. The request is validated exactly like a real submission and nothing is stored, emailed or forwarded to sales:

curl -sS -X POST "https://www.hitcommunications.com/api/v1/contact?dry_run=true" \
  -H "Content-Type: application/json" \
  -d '{"name":"Ana Souza","email":"ana@example.com","country":"Brazil","message":"We need Microsoft Teams telephony for 300 users."}'

Real contact-form submissions require the CAPTCHA token issued by the website form, so the final step is always taken by a person on the contact page.

• OpenAPI 3.1: https://www.hitcommunications.com/openapi.json
• llms.txt: https://www.hitcommunications.com/llms.txt
• OAuth protected resource metadata (RFC 9728): https://www.hitcommunications.com/.well-known/oauth-protected-resource/api/admin
• Sitemap: https://www.hitcommunications.com/sitemap.xml

• URL path versioning: /api/v1/… is the current contract; every response carries API-Version: 1.
• Breaking changes ship under a new path (/api/v2/…). Additive changes (new optional fields or endpoints) can happen within v1.
• A deprecated version keeps working for at least 180 days after the deprecation is announced. Deprecated operations answer with Deprecation (RFC 9745), Sunset (RFC 8594) and Link rel="deprecation" headers and are marked deprecated in the OpenAPI document.

Per client IP: 120 read and 60 write requests per 60 seconds. Responses carry the IETF RateLimit-Policy and RateLimit headers; a 429 response adds Retry-After.

API-Version: 1
RateLimit-Policy: "read";q=120;w=60
RateLimit: "read";r=119;t=60

Every API error is a JSON object with a stable code, a message, the HTTP status, a hint on how to fix it and a link to the OpenAPI document:

{
  "error": "Invalid blog listing parameters.",
  "code": "validation_failed",
  "message": "Invalid blog listing parameters.",
  "status": 400,
  "hint": "locale must be a site locale (en-us, es-co, …)",
  "docs": "https://www.hitcommunications.com/openapi.json"
}

Public endpoints need no authentication. Back-office endpoints under /api/v1/admin require a Supabase Auth session and a module permission; the scopes (admin:blog, admin:cms, admin:users and others) are declared in the OpenAPI security schemes and in the RFC 9728 metadata.

For demos, proposals and integrations, use the contact page: https://www.hitcommunications.com/en-us/contact