API reference

Everything the app does travels this API: the web app never talks to the database directly, so there is no back door a script misses. Below are all 757 endpoints, grouped by area, each with the permission your key has to carry.

How to mint a key, and how errors, paging and rate limits work, is in REST API. This page is the map; that page is the manual.

Note

This page is generated from the API’s own OpenAPI document. Field-level schemas are not repeated here; your instance serves the authoritative ones.

On your own instance the interactive version sits at /api/docs, with the document itself at /api/openapi.json. That one knows which modules you switched on, so it is shorter than this list and always exactly right.

The areas

Clients and contacts (33) The hub every other module attaches to: the client record, the people at that client, the paper trail of what changed, and the address lookup the forms use.

Work: projects, tasks, hours (99) What the agency actually does, and what it bills: projects with budgets, task boards and checklists, the timer and the timesheet, and every contact moment on one timeline.

Money: invoices, quotes, retainers (106) Invoices and quotes built from the work that produced them, recurring agreements, the payment provider that settles them and the bookkeeping package they end up in.

Assets: domains, sites, hosting (91) What an agency looks after on a client's behalf, and the four services it reads that from: the registrar, the DNS zone, the monitor and the site itself.

Marketing and reporting (118) The client's numbers, the advertising that moves them, the container that measures them, and the monthly document that explains them.

People: leave, contracts, portal (59) Employees rather than client contacts: leave balances and requests, employment periods and work schedules, and the login a client gets to look in.

Google Workspace (25) Calendar, Drive, Gmail and Contacts, connected per organisation with your own OAuth client and switched on per employee.

Access: members, roles, keys (61) Who may sign in, what they may do once they have, which clients they may see, and the keys that let a script act on their behalf.

Platform (165) Everything cross-cutting: the tenant metadata a client fetches first, files, notifications, automation rules, AI, custom fields, spreadsheets and bulk edits.

What is not here

Three groups of endpoints are deliberately left out, the same three that never become MCP tools: the installation console (/instance), the cloud provisioning routes, and the first-run wizard (/setup). They are not part of an agency workspace, and they are gated on a different axis from the permissions below.