Partners and API / Partner API
Every endpoint scoped to your organization
Programmatic access across every service module, governed by exactly the same entitlement-then-role check as the interface.
An API that bypasses the permission model is not an API, it is a hole. The check happens server-side on every request whether the caller is a browser or a script.
Talk to our engineersDoes the API have its own permission model?
No, and that is the point. It uses the same one: entitlement first, role second, both default-deny, both evaluated server-side per request. A token cannot reach a portal its organization has not bought, and cannot exceed the role it was issued for.
Same walls, different caller
How programmatic access is governed
- 01
Keys are issued and revocable
API keys are managed alongside users, and revocation takes effect immediately rather than at expiry — the same denylist behavior as a session.
- 02
Entitlement then role
Identical ordering to the interface. There is no API-only elevation and no service key with universal read.
- 03
Tenant scoping applies
The organization comes from the credential, never from a parameter, and forced row-level security sits underneath as the second wall.
- 04
Calls are audited
Programmatic writes are audited exactly like interface writes, with the calling identity recorded rather than a generic “API” actor.
- 05
Service principals for machines
Machine identities have no interactive login and cannot be assigned to a person, so a batch run is never mistaken for somebody’s afternoon.
For a developer evaluating this
The figures and the ground rules
These describe the shipped surface. Ask us for the reference and we will give you the real one rather than a marketing summary.
Endpoints
Scoped to your organization, every one
Authentication
API keys, revocable, denylisted immediately on revocation
Authorisation
Entitlement then role, server-side, per request
Tenancy
From the credential; no organization parameter is accepted
Audit
Writes audited with the calling identity
Schema stability
245 ordered, reversible migrations behind the surface
Where we are honest with developers
A developer will find these out in week one. Better they hear them from us in week zero.
Rate limits exist
The API is rate limited, and bulk operations should use the bulk lanes rather than looping a single-record endpoint.
No public sandbox yet
Evaluation happens in a provisioned environment with us rather than a self-service sandbox you can sign up for today.
Not every screen has an endpoint
Every endpoint is broad, not total. Ask specifically about the workflow you intend to automate.