Phase 8 developer surface

Public API shell for integrations, settings, and webhook consumers

The current public API is centered on tenant-scoped integration management and outbound event delivery. API keys authenticate with standard bearer auth against the versioned REST base path /api/v1.

Download Postman Collection Open Integrations Workspace

Authentication

API keys use bearer auth. Operator-only credential lifecycle routes still require a company session token.

Header: Authorization: Bearer tb_live_...

Base URL: https://your-domain.example/api/v1

Current API key scope is intentionally narrow: integrations and company settings for the developer role, plus outbound webhook consumption.

Outbound Webhook Signature

Subscribed deliveries are signed with HMAC SHA-256 over timestamp and body.

Headers: x-toolbridges-event, x-toolbridges-event-id, x-toolbridges-delivery-id, x-toolbridges-timestamp, x-toolbridges-signature

request_body = raw JSON body
signed_payload = "{timestamp}.{request_body}"
signature = "sha256=" + hex(HMAC_SHA256(signing_secret, signed_payload))

Bearer-key routes

These routes are intended for developer/API automation today.

GET/integrations

List live integration connections, webhook subscriptions, automation triggers, and connector blueprints.

POST/integrations

Create a WooCommerce or Shopify connection with credential and template-mapping settings.

PATCH/integrations/:connectionPublicId

Update connector display settings and order-status template mappings.

POST/integrations/:connectionPublicId/test

Probe credentials and refresh store metadata.

POST/integrations/:connectionPublicId/sync

Run an on-demand sync/probe for the configured commerce connection.

GET/company/settings

Read tenant settings that are available to the developer/API role.

PATCH/company/settings

Update tenant support, notification, security, and retention settings.

Session-only operator routes

These routes power the workspace UI and intentionally stay outside API-key scope.

GET /developer/api-keys

POST /developer/api-keys

POST /developer/api-keys/:apiKeyPublicId/rotate

POST /developer/api-keys/:apiKeyPublicId/revoke

POST /developer/webhook-subscriptions

PATCH /developer/webhook-subscriptions/:subscriptionPublicId