Platform
API and webhooks
Everything the dashboard does goes through the same REST API you can call. Events leave as signed webhooks that are retried until they land.
Authentication
- The session cookie issued by the one-time-code flow, or the same signed token as a bearer header.
- A personal API token as a bearer header. It acts as its owner, so every role and scope check applies unchanged; read-scoped tokens are refused mutations.
- Each route declares its minimum role: any authenticated user, manager and above, admin, or superadmin. Data routes then scope by the caller’s tree.
curl -H "Authorization: Bearer <token>" https://inroots.example.com/api/export/hours.csv?from=2026-08-01&to=2026-08-31
Discovering it
The OpenAPI schema is generated from the routes and served, admin-gated, with an interactive explorer inside the product. Summaries and descriptions come from the route definitions, so they cannot drift from the code.
GET /api/openapi.json GET /api/docs
| Efficiency, Goals, Work health, Timeline | scores, targets, benchmarks, objectives, people signals, overwork risk, one-day evidence |
|---|---|
| PTO, On-call, Teams, Holidays | leave rules and requests, rotations and coverage, team settings, calendars |
| DM, Contact, Consent | sends and schedules, contact details, agreements and signatures |
| AI providers, Reports, Alerts | provider switch and failover order, PDF exports, email transport |
| Integrations, Export | tokens, webhooks, CSV |
| ML | predict, feedback, decisions, metrics, models, promote, train |
Outbound webhooks
- Created with a target URL and a secret that is never returned again; the list shows only whether a secret exists.
- Each delivery carries a signature header with a SHA-256 HMAC over the exact body, an event header and a delivery ID for de-duplication.
- Emission rides the caller’s transaction, so an event is never delivered for a decision that rolled back, and a receiving endpoint that is down never blocks an approval.
- A flush job posts every minute and retries at 1, 5, 15, 60 and 360 minutes before abandoning with the reason recorded. Twenty consecutive failures open the endpoint’s circuit until an admin re-enables it.
- The Test button queues a signed ping through the real path. Events currently emitted: pto.approved and pto.declined.
expected = hmac.new(secret, body, sha256).hexdigest() compare(header, "sha256=" + expected)
Inbound
- Slack events and interactive actions; Teams activities; the WhatsApp webhook.
- Support tickets from external systems, de-duplicated on an external reference so follow-ups update one ticket.
- Any webhook can trigger an n8n workflow that calls the API back with a token.
Live stream
A server-sent event stream carries attendance events and personal notifications to the dashboard and to any client you write. Personal events reach only the person they concern.
GET /api/events