Developers
Do through the API what the screens do: the same permissions, the same rules, the same audit trail.
API and webhooks
- REST API under /api/v1 for companies, projects, invoices and payments, time entries and expenses
- Authenticate with a personal access token or OAuth 2; every call runs with the token holder's own permissions
- Writes through the API pass the same validation, permissions, period locks and audit log as the screen
- OpenAPI 3.1 description, public at /api/v1/openapi.json
- OAuth access tokens last 2 hours; refresh tokens rotate on every use, and a replayed one revokes the grant
- Up to 10 webhook endpoints per business, subscribed to events like invoice.created or time_entry.*
- Each delivery is signed with an HMAC-SHA256 of timestamp and body in the X-Cobista-Signature header
- Failed deliveries retry after 1, 5, 30, 120 and 720 minutes; payloads carry the record's type and id, not its content