Skip to main content

​
Base URL

Replace {host} with the hostname of your deployment.

​
Authentication

Create a session with POST /sessions, then send the returned token on every protected request:
Tokens must stay associated with a valid server-side session. company_id is not inferred from the token; pass it where an endpoint requires it.

​
Responses and errors

  • Collections return bare JSON arrays; single items return bare JSON objects.
  • Errors return { "error": "message" }. Authentication and activity proxy errors use plain text.
  • Unsupported methods on a registered path return 405 with an Allow header.

​
Pagination

Only endpoints that document page / per_page are paginated. Defaults are page=1 and per_page=100; values above the cap are clamped, not rejected.
  • X-Total-Count header: total number of matching records.
  • Link header: navigation links (omitted when there is a single page).
Aggregate endpoints use limit (default 50, max 200) instead and send X-Truncated when rows were omitted.

​
Query parameters

  • Array parameters accept repeated keys (?id=a&id=b) or comma-separated values. Prefer repeated keys for long UUID lists.
  • Where available, fields selects the exact response properties; unsupported fields return 400.

​
Dates

Calendar dates use YYYY-MM-DD and monthly periods use YYYY-MM. PATCH endpoints only change the documented properties and reject unknown ones.