/

Developer documentation

Build on WorkSuite: the modules, the permission model, the REST API and your own extensions — against the same records every app uses. This section is being generated from the routing table and the permission definitions rather than written from memory, which is why it is behind the module reference.

Suggest an edit

REST API2,644 routes, one key at a timeEvery module is reachable over the same routes the application itself uses, with keys that carry a scope and inherit permissions rather than escaping them.

IntegrationsConnect what you already runSales channels, storage, telephony, document editing and your own software connect deliberately — connect, test, sync, and read the logs afterwards.

# Keys are issued in Administration → API & Integrations.
# A key carries a scope, is shown to you once, and is stored only as a hash.

curl "https://[YOUR-SERVER]/[ROUTE]" \
  -H "Authorization: Bearer [YOUR-API-KEY]"

# X-API-Key: [YOUR-API-KEY] is accepted in place of the Authorization header.

What is available now

The integrations page covers what the suite talks to; on-premise implementation covers running it on your own infrastructure; and the API & Integrations guide covers key handling in practice. For an interface specification against a specific integration, ask — it is quicker than waiting for the section, and the answer comes out of the routing table either way.

Ask for API access

Six sections

Published as each is generated and checked against a running installation.

01Modules and the registryWorkSuite is a modular monolith: each app is a module with its own routes, models and permissions. How a module is switched on and off, what it declares it depends on, and why the suite refuses an arrangement that would leave a gap.
02The permission modelHow the 335 named permissions are defined, grouped and checked — and the convention that keeps "view" from ever implying "send out". The part to read before writing anything that exposes a record.
03The APIAuthentication, key issuing and revocation, and the 2,644 routes an authorised caller can reach. Request and response shapes will be published from the routing table rather than written by hand, so they cannot drift from the software.
04Webhooks and integrationsWhat the suite will call out to, when, and how to verify that a call came from it. Retry behaviour, and what happens to an endpoint that stops answering.
05Data and multi-companyWhich records are scoped to a company and which are installation-wide — the single distinction that causes the most trouble when an integration is written against a single-company installation and then meets a group.
06Deployment and environmentsRunning it on your own infrastructure: requirements, configuration, storage back-ends, upgrades, and what a safe deployment looks like.