> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudhumans.com/llms.txt > Use this file to discover all available pages before exploring further. # List contacts by id > Returns the contacts whose ids you send in `ids`, with name, email, phone number, identifier and custom attributes. Use it after [list conversations](/api-reference/cloudchat/endpoints/list-conversations): collect each conversation's `contact.id`, drop duplicates, and send them here in batches of up to 100. An id that is not a contact of this account is left out of `data` without an error — that includes ids of contacts in other accounts. Compare the ids you get back with the ids you sent to know which were not found. Only account administrators can read contacts through this API. ## OpenAPI ````yaml api-reference/specs/cloudchat/v1.json GET /v1/accounts/{accountId}/contacts openapi: 3.0.1 info: title: Cloud Chat API version: v1 description: >- The curated public surface of Cloud Chat. Every call needs two things: the Bearer token from `POST /auth/v1/signin`, and the `cloudchat-instance` header that says which Cloud Chat instance your company lives on. If you don't know your instance value, the [Find your credentials](/api-reference/cloudchat/credentials) page reads it out of your own token in the browser. servers: - url: https://api.cloudhumans.com/cloudchat description: Production security: - bearerAuth: [] tags: - name: Canned Responses description: >- Canned responses — the shortcuts agents expand while replying. Each one belongs to a single account and is identified by its short code. - name: Conversations description: >- Read-only access to the conversations of an account. What you can see follows the same rule as the dashboard: an administrator token sees every inbox, an agent token only the inboxes it is a member of. - name: Contacts description: >- Customer contacts of the account, with their personal data. Administrators only. - name: Help Center description: >- Portals, categories and articles of the help center — the public FAQ your customers read. - name: Uploads description: Store the images help center articles embed. - name: Labels description: >- Read-only access to the labels an account has defined. A label is a tag conversations and contacts carry; this endpoint only lists the label definitions themselves. - name: Inboxes description: >- Read-only access to the inboxes a token can see — every inbox of the account for an administrator, only its memberships for an agent. Never includes the channel's credentials. - name: Agents description: >- Read-only access to the human and AI agents of an account. A hidden admin (the platform's own support user) never appears, on the list or by id. - name: Teams description: >- Teams group agents for assignment. Listing and reading are open to any member; creating and updating a team, and managing its membership, require an administrator token. A system-managed team (provisioned by the platform) can be read like any other but never updated. - name: Macros description: >- Macros bundle a sequence of actions an agent runs against a conversation from the dashboard. This surface lets you list, read and write macro definitions — running one is not part of the v1 contract. A macro is either `global` (visible to the whole account) or `personal` (visible only to its author); an agent token can only create personal macros. - name: Automation Rules description: >- Read-only access to the account's automation rules — administrator only. An agent token gets a 403 on every operation in this group. - name: Availability Reasons description: >- The reasons an agent can go `busy` for, configured per account. Listing is open to any member; creating, updating and deleting require an administrator token. Deleting is a soft delete — the reason disappears from listings but agents' past availability history keeps referencing it. - name: Native Attribute Requirements description: >- Which native conversation attributes (priority, assignee, tag, team) the account requires agents to fill before resolving a conversation. Listing is open to any member; requiring and un-requiring need an administrator token. Deleting a requirement is reversible — require the same key again to restore it. - name: Campaigns description: Check who a campaign would reach, send it, and read the result back. - name: Reports description: The numbers of the Cloud Chat reporting dashboards, read through the API. paths: /v1/accounts/{accountId}/contacts: parameters: - $ref: '#/components/parameters/CloudChatInstance' - $ref: '#/components/parameters/AccountId' get: tags: - Contacts summary: List contacts by id description: >- Returns the contacts whose ids you send in `ids`, with name, email, phone number, identifier and custom attributes. Use it after [list conversations](/api-reference/cloudchat/endpoints/list-conversations): collect each conversation's `contact.id`, drop duplicates, and send them here in batches of up to 100. An id that is not a contact of this account is left out of `data` without an error — that includes ids of contacts in other accounts. Compare the ids you get back with the ids you sent to know which were not found. Only account administrators can read contacts through this API. operationId: listContacts parameters: - name: ids in: query required: true description: >- Comma-separated contact ids, e.g. `12,34,56`. Up to 100 distinct ids per request; a repeated id counts once and comes back once. Missing, non-numeric, sent as an array (`ids[]=`) or over 100 distinct ids answers `400`, with `error.details` naming `ids`. schema: type: string example: 12,34,56 responses: '200': description: >- The contacts found among the requested ids, ordered by id. `data` is empty when none of them is a contact of this account. content: application/json: schema: $ref: '#/components/schemas/ContactList' '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/ContactsForbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/TooManyRequests' '500': $ref: '#/components/responses/InternalError' components: parameters: CloudChatInstance: name: cloudchat-instance in: header required: true description: >- Your Cloud Chat instance ID — an integer, fixed for your company, told at onboarding. [The API overview](/api-reference/cloudchat/overview#two-headers-every-call) explains how instances work, how to find yours, and the errors a wrong or missing value produces. schema: type: integer example: 1 AccountId: name: accountId in: path required: true description: >- Your Cloud Chat account. It has to be an account your token grants membership on, and it has to live on the instance in the `cloudchat-instance` header — the two travel together. Account numbers are only unique **within** an instance, so the same number is a different company on another instance. Usually a mismatched pair fails closed with a 401, because your user does not exist on the other instance — but if your identity happens to exist on both, the call succeeds against the other company's data, silently. Read it and you are looking at the wrong help center; write it and you have stored into the wrong account. Send the two values that were given to you together, and never try a number to see what answers. schema: type: integer example: 1 schemas: ContactList: type: object description: The contacts found among the requested ids. required: - data properties: data: type: array description: >- Ordered by id. Requested ids that are not contacts of this account are absent. items: $ref: '#/components/schemas/Contact' Contact: type: object description: A customer contact of the account. required: - id - name - email - phone_number - identifier - custom_attributes - created_at - last_activity_at properties: id: type: integer description: >- The contact id — the same `contact.id` the conversation endpoints return. example: 815 name: type: string nullable: true description: >- The display name. Often what the channel reported, such as a WhatsApp profile name; an empty string when unknown. example: Jane Doe email: type: string nullable: true description: The email address, `null` when the contact has none. example: jane@example.com phone_number: type: string nullable: true description: The phone number in E.164, `null` when the contact has none. example: '+5511999998888' identifier: type: string nullable: true description: >- The id your own systems use for this contact, when one was set through an integration; `null` otherwise. example: crm-42 custom_attributes: type: object nullable: true additionalProperties: true description: >- The contact's custom attributes, keyed by attribute key, exactly as configured on the account. An empty object when none are set. example: plan: pro created_at: type: string format: date-time description: When the contact was created. ISO 8601 in UTC, with milliseconds. example: '2026-09-02T14:03:11.215Z' last_activity_at: type: string format: date-time nullable: true description: >- When the contact last had activity, in the same format. `null` when it never had any. example: '2026-10-20T09:41:27.000Z' Error: type: object description: The error envelope every Cloud Chat API response uses. required: - error properties: error: type: object required: - code - message properties: code: type: string description: >- The stable, machine-readable reason. Branch on this, never on `message`. enum: - unauthorized - forbidden - not_found - validation_failed - bad_request - internal_error - rate_limited - service_unavailable example: not_found message: type: string description: >- The reason in words, localized to your account's language (English, Spanish or Brazilian Portuguese; English when the account is set to anything else). Wording changes with the account and between releases, so never match on it. Two cases stay in English whatever the account is set to: `unauthorized`, decided before any account is known, and the account-level `not_found`, which must not reveal the account's language. example: Resource could not be found. details: type: array description: >- Present on some rejections — a 400 for a refused query parameter or upload mode, for example. One entry per offending field, localized to the account's language like `message` — match on `code` and `field`, never on the text. items: type: object required: - field - code - message properties: field: type: string description: Which request field the rule was about. code: type: string description: Stable, machine-readable reason. message: type: string description: The rule in words. GatewayError: type: object description: >- Rejected by the gateway before Cloud Chat saw it, so it does not use the `error` envelope. required: - message properties: message: type: string example: API rate limit exceeded request_id: type: string description: Gateway request id. Quote it when reporting a problem. example: f3f7567638d4b65a8003057d0c77d275 responses: BadRequest: description: >- The request itself is malformed, before any value is validated: - a body that isn't valid JSON, or one with no `canned_response` wrapper, - a `canned_response` that isn't an object (`{"canned_response": "text"}`), - `page`, `per_page`, `search` or `sort` sent as an array or a nested object (`?page[]=1`, `?sort[x]=y`) instead of a plain value, - **the `cloudchat-instance` header missing or holding a value we don't route,** - an `accountId` that is not a number — including the literal `{accountId}` that some API clients send when the argument is left unset. This one answers with the normal envelope and `error.details` naming `accountId`, and it is deliberately **not** a 404: a 404 would mean the account cannot be reached, while this means the value was never an account id at all, so re-read the argument instead of trying other numbers. **Two different shapes answer with 400, and the difference will bite you on day one.** That last case is rejected before the request reaches the API, so `error` is a plain **string** instead of the usual object: ```json { "error": "" } ``` Every other 400 uses the normal envelope, where `error` is an object with `code` and `message`. Reading `error.code` without checking the type first throws on the missing-header case — which is the most likely 400 of your first integration. Check `typeof error === "string"` first, or read `error?.code` defensively. A 400 always means fix the request shape; it never means a value was rejected. Rejected values are 422. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: bad_request message: The request is malformed. Unauthorized: description: >- No Bearer token, or one that is expired, malformed, or not a Cognito token. Sign in again for a fresh `id_token`. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: unauthorized message: >- Authentication is required. Send a valid Bearer token in the Authorization header. ContactsForbidden: description: >- Reading contacts needs an administrator of the account; any other role answers `403` with the message below. A suspended account also answers `403`, and then nothing on it works until it is reactivated. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: forbidden message: >- Contact data is available to account administrators only. Ask an administrator of this account to run this request. NotFound: description: >- The resource is not there for you. Three situations answer with this code, and the first two apply to **every** endpoint — the account is resolved before anything else runs, so a list or a create fails this way too: - the account does not exist on this instance, - the account exists but your token has no membership on it, - on an endpoint that names one, the resource it names (a canned response, a portal, an article) does not exist where the path says it does. The first two are deliberately indistinguishable — same status, same body, and the message stays in English in both, since translating it would reveal the account's configured language. So you cannot use this endpoint to find out which account ids exist. The third case is localized like every other error, which is safe because you only reach it once membership is established. Either way a 404 is not worth retrying. Check the `accountId`, the `cloudchat-instance` value, and that your user is a member of the account. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: not_found message: Resource could not be found. TooManyRequests: description: >- Rate limited per credential. Note the envelope: this one is `{ "message": ... }`, because the request never reached the API. Don't hardcode the limit — read it from the response. `Retry-After` says how many seconds to wait, and every response (not just this one) carries `ratelimit-limit`, `ratelimit-remaining` and `ratelimit-reset`, the last in seconds. content: application/json: schema: $ref: '#/components/schemas/GatewayError' example: message: API rate limit exceeded InternalError: description: >- Something failed on our side. The response never carries the underlying error, but it is reported to our monitoring automatically — no need to file anything for a one-off. Retrying is reasonable, with one caveat on `POST`: a 500 does not prove the write did not happen, so a retry can come back `422` with `short_code` already taken. That 422 means the first attempt succeeded — list the account and confirm before treating it as a failure. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: internal_error message: An unexpected error occurred. Please try again later. securitySchemes: bearerAuth: type: http scheme: bearer bearerFormat: JWT description: >- The `id_token` from `POST /auth/v1/signin`, sent as `Authorization: Bearer `. Not the `access_token` — that one does not carry the identity Cloud Chat authorizes on. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.