Integrations, provisioning & extensions
Separate the available API from integration capabilities that still need qualification.
What you can inspect now
The API reference exposes the Go HTTP contract used by the native application. Download the OpenAPI file to inspect schemas and prepare typed clients. Browser authentication, company scope and feature permission checks remain mandatory.
Internal modules or development tests are not evidence of a supported public integration endpoint. If an operation is absent from this published contract, do not invent its URL from a feature name.
Provisioning and identity lifecycle
Company SSO is a reviewed federation workflow. SCIM provisioning, an integration credential console and customer-facing lifecycle management are separate capabilities awaiting qualification and UI completion. SSO alone does not create, suspend or role-map company members automatically.
Webhooks and third-party access
Company settings → Integrations supports named API accounts, scoped tokens and signed learning webhooks with test deliveries, history and redelivery. See Company API access & webhooks for supported datasets and limits. Events & integrations remains the separate analytics-provider page. n8n/Zapier account-level workflows and native mobile authentication remain separately qualified work.
Agree an integration contract
- List the data to read or write and the company boundaries involved.
- Choose an approved authentication and least-privilege permission model.
- Agree endpoint/version guarantees, pagination, retry and failure behaviour.
- Test cross-company denial, revoked access and duplicate delivery in a separate test installation.
- Document operational ownership and acceptance evidence before rollout.