RallyText API

Manage your roster and groups, send and schedule texts, and read delivery status from your own systems. The API is included on Team Plus and up: Team Plus, Organization and Business plans, monthly or season. Teams on lower plans get plan_required.

Authentication

A head coach or team director creates keys in the dashboard under Settings → Developers. A key is shown once. It acts on behalf of the person who created it. If that person stops being a head coach or team director on the team, or loses permission to send broadcasts, the key is revoked for good and its scheduled messages are not sent. Giving them the role back does not bring the key back. If their roster entry is blocked, the key stops working completely, reads included (sender_blocked). The key is not revoked: it works again once they are unblocked. You can revoke a key at any time, on any plan.

Authorization: Bearer rt_live_your_key_here

All requests and responses are JSON. Every path below starts with https://rallytext.app/api/v1. Paths have no trailing slash. Machine-readable description: /api/v1/openapi.json. Postman users can download a collection: set api_key to your key.

Responses and errors

Successful responses wrap the result in data. Lists also return pagination (limit up to 200, offset, has_more, next_offset). Errors look like this:

{"error": {"code": "plan_required", "message": "..."}}

Some errors add fields, for example existing_member_id on member_exists.

Rate limits

Each key gets 120 requests per minute across all endpoints. Sends on POST /api/v1/messages, scheduled ones included, are limited to 20 per minute and 200 per hour per key. Requests without a valid key are limited to 60 requests per minute per IP address. Over a limit you get 429 rate_limited. Bulk opt-outs, recipient checks, delivery reports and analytics also share a limit of 10 per minute per key.

What the API does and does not do

• /api/v1/messages and /api/v1/scheduled cover broadcasts only. Urgent alerts can't be sent through the API; use the dashboard.
• Sends follow the same rules as the dashboard: approval policies, opt-outs, and the team prefix and opt-out text RallyText adds to each message.
• Members who texted STOP are never texted and can't be re-subscribed through the API: not by editing status, changing their number, adding the number again, or deleting and re-adding the member. You can record opt-outs with the API, but you can't remove them.
• Staff (head coach, assistant coach, coach, team director), board members, and anyone with a dashboard login are managed in the dashboard. The API returns staff_member_protected for them.
• A team can have up to 100 pending scheduled messages created through the API.
• Urgent alert templates can't be created, changed, deleted or sent through the API.
• Values in private custom fields can be written through the API but are never returned by it.
• Drip campaigns are created in the dashboard. The API can list, pause, resume and cancel them.
• The API can read the inbox and mark texts read, but it can't reply. Replies go from the dashboard or from a staff phone.

Endpoints

Examples

Add a member

curl -X POST https://rallytext.app/api/v1/members \
  -H "Authorization: Bearer rt_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"name": "Jordan Lee", "phone": "(906) 555-1234", "role": "athlete"}'

Send to everyone

curl -X POST https://rallytext.app/api/v1/messages \
  -H "Authorization: Bearer rt_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Practice moved to 5pm today.", "audience": "all"}'

A message that needs approval under your team's policy waits in the dashboard's Approvals queue instead of going out.

Schedule for later

curl -X POST https://rallytext.app/api/v1/messages \
  -H "Authorization: Bearer rt_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Reminder: picture day tomorrow.", "audience": "families", "scheduled_for": "2026-10-20T17:00:00-04:00"}'

scheduled_for is ISO 8601 with a timezone offset, from one minute to one year ahead.

Repeat every week

curl -X POST https://rallytext.app/api/v1/messages \
  -H "Authorization: Bearer rt_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"text": "Practice tonight at 6.", "audience": "all", "scheduled_for": "2026-10-20T17:00:00-04:00", "repeat": {"every": "week", "until": "2026-12-15"}}'

Each week is checked and sent like a new message. If a week is refused (for example the key was revoked), the series stops. A week that waits in the approval queue counts as sent, so the next week is still scheduled even if that approval is rejected or expires.

Webhooks

Webhooks send events to your server, or to Zapier, as they happen. A head coach or team director adds them in the dashboard under Settings → Developers, or you can add them with POST /api/v1/webhooks. Each webhook has a signing secret that is shown once, when you create it. Webhooks are included on Team Plus and up: Team Plus, Organization and Business plans. A team can have up to 25.

Events

Phone numbers are in E.164 format (for example +19065551234) and belong to your own members. A member who is on your roster twice (for example a parent of two athletes) gets one member.* event per roster entry.

The request

RallyText sends an HTTP POST with a JSON body and these headers:

{"id": "evt_3f0c9a...", "type": "message.received", "created_at": "2026-10-08T14:03:11.402311Z",
 "team": {"id": "6b1d...", "code": "HAWKS"},
 "data": {"message_id": "a41e...", "provider_message_id": "40317f...", "from": "+19065551234",
          "to": "+19065550000", "body": "Running 10 minutes late", "keyword": null, "group_id": null,
          "member": {"id": "c9d2...", "name": "Jordan Lee", "role": "athlete"},
          "received_at": "2026-10-08T14:03:11.398004Z"}}

Verifying the signature

v1 is the hex HMAC-SHA256 of the timestamp, a period, and the raw request body, using your whole webhook secret as the key: the full whsec_... string, prefix included, as UTF-8 text. Do not base64-decode it (some other webhook libraries do). Compute it over the exact bytes you received, before parsing the JSON. Compare in constant time, and reject requests whose timestamp is more than 5 minutes old.

X-RallyText-Signature: t=1760000000,v1=5f2b6c...

import hashlib, hmac, time

def verify(secret, header, body, tolerance=300):
    try:
        parts = dict(p.split("=", 1) for p in header.split(","))
        t, sig = parts["t"], parts["v1"]
        if abs(time.time() - int(t)) > tolerance:
            return False
    except (KeyError, ValueError):
        return False
    expected = hmac.new(secret.encode(), t.encode() + b"." + body, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, sig)

Responses and retries

Reply with any 2xx status within 10 seconds. Redirects are not followed. If a delivery fails, RallyText tries again after 1 minute, 5 minutes, 30 minutes, 2 hours and 12 hours, then gives up on that delivery. Deliveries go out once a minute, so expect up to a minute's delay. The same event can arrive more than once, so use the event id to ignore duplicates. After 20 failed attempts in a row, the webhook is turned off and your head coaches and team directors get an email. Turn it back on in Settings → Developers once your endpoint works.

Plan changes and access

If your team moves below Team Plus, nothing is sent. Events that happen while you are below Team Plus are marked skipped and are not sent later, even after you upgrade again. You can still list and delete your webhooks, in the dashboard or with GET and DELETE /api/v1/webhooks, so an integration can unsubscribe.

Webhooks added with an API key are deleted when that key is revoked, including when the key is revoked because the person who created it is no longer a head coach or team director. Webhooks added in the dashboard are turned off when the person who added them is no longer a head coach or team director, or loses permission to send broadcasts. The webhook then shows disabled_reason creator_inactive, and another head coach or team director can turn it back on. Whoever turns it back on becomes the person it belongs to.

URL rules

Webhook URLs must use https:// and must resolve to a public internet address. URLs that point to private, loopback or link-local addresses are refused when you save them (blocked_url) and again before every delivery. Other mistakes in the URL return invalid_url, and an empty or unknown event list returns invalid_events. Past 25 webhooks you get webhook_limit. If we cannot look up the host name right away, you get a 503 dns_busy; try again in a minute.

Add a webhook with the API

curl -X POST https://rallytext.app/api/v1/webhooks \
  -H "Authorization: Bearer rt_live_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{"url": "https://example.com/rallytext-webhook", "events": ["message.received", "member.opted_out"]}'

Response (201): the webhook, including "secret": "whsec_...". Store the secret; it is not shown again. Webhooks added with a key are deleted if that key is revoked, including when it is revoked because its creator stopped being a head coach or team director. Webhooks added in the dashboard are not affected.

Help

Questions: support@rallytext.app.