API & integrations
The API is not an afterthought
Versioned routes, per-device tokens, the same authorisation rules.
A versioned prefix
The public contract is frozen: changes are additive, and anything breaking would require a new version. A legacy alias exists only for transition.
A published schema
An OpenAPI document of record describes every route, so clients can be generated rather than hand-written.
Token pairs per device
Credentials exchange for an access and refresh pair, one row per device, hashed at rest, each revocable on its own.
The contract
What integrating actually involves
A versioned prefix
The public contract is frozen: changes are additive, and anything breaking would require a new version. A legacy alias exists only for transition.
A published schema
An OpenAPI document of record describes every route, so clients can be generated rather than hand-written.
Token pairs per device
Credentials exchange for an access and refresh pair, one row per device, hashed at rest, each revocable on its own.
The same authorisation
Tokens resolve through the same code path as a browser session, so every tenancy and role rule applies unchanged.
A stable error envelope
Every error carries a human detail and a stable machine code; validation failures add a flat field map.
Rate limiting where it matters
Credential endpoints are rate-limited, and failures are deliberately uniform.
What teams build with it
Common integrations
- Pushing actuals from an ERP or ledger export into a spread each month
- Reading validated document text into a data warehouse
- Syncing the client registry with an existing CRM as the system of reference
- Feeding pipeline figures into a firm-wide dashboard
- Scripted bulk upload of a data room at the start of a diligence
- Exporting spreads and schedules into a client's own reporting template
What is not there
There are no outbound webhooks yet, and no packaged connectors for specific accounting or CRM products. Integrations today are built against the REST API, which is stable and documented — but if you need a push model rather than a poll, say so during evaluation.
Rate limits outside the credential endpoints are generous and not currently contractual. For a high-volume integration, we will agree limits with you in writing rather than leave it to chance.
About the API
Is the API available on every plan?
Yes. It is the same API the product's own interface uses, and access is governed by the permissions of the account whose token you are using.How do we revoke access for a departing employee?
Disable the account: live sessions end immediately and their device tokens stop resolving. Individual device tokens can also be revoked one at a time.
Talk to us about your deployment
Bring your security questionnaire, your network constraints and your timetable. We would rather answer the hard questions before a pilot than after one.