Integrations, provisioning & extensions
Separate the available API from integration capabilities that still need qualification.
What you can inspect now
The API reference exposes the Go HTTP contract used by the native application. Download the OpenAPI file to inspect schemas and prepare typed clients. Browser authentication, company scope and feature permission checks remain mandatory.
Internal modules or development tests are not evidence of a supported public integration endpoint. If an operation is absent from this published contract, do not invent its URL from a feature name.
Provisioning and identity lifecycle
Company SSO is a reviewed federation workflow. SCIM provisioning, an integration credential console and customer-facing lifecycle management are separate capabilities awaiting qualification and UI completion. SSO alone does not create, suspend or role-map company members automatically.
Webhooks and third-party access
Self-service webhook subscriptions, API credential issuance, native mobile authentication and general server-to-server access are not available through the current customer UI. Define required events, permissions, signing, retries and revocation with your implementation contact before integration development.
Agree an integration contract
- List the data to read or write and the company boundaries involved.
- Choose an approved authentication and least-privilege permission model.
- Agree endpoint/version guarantees, pagination, retry and failure behaviour.
- Test cross-company denial, revoked access and duplicate delivery in a separate test installation.
- Document operational ownership and acceptance evidence before rollout.