REST API

Build powerful integrations.

A versioned, JSON REST API secured with per-key authentication. Subscribe to webhooks for 12 events across jobs, invoices, payments, estimates and customers. Available on the Scale tier.

Per-key authentication Versioned REST · v1 12 webhook events 5 jurisdictions
bash · Create a job via the REST API
curl https://api.servicesynchq.com/api/v1/jobs \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "customerId": 12345,
    "scheduledDate": "2026-08-20T14:00:00Z",
    "title": "HVAC repair"
  }'
json · Response · streaming in
201 Created
{  "id": 84213,  "customerId": 12345,  "status": "scheduled",  "scheduledDate": "2026-08-20T14:00:00Z",  "title": "HVAC repair",  "createdAt": "2026-07-24T08:14:22Z"}
REST API · v1
Stable, versioned, JSON
X-API-Key
Per-key authentication
Full CRUD
Across your data
12 events
Real-time webhooks
API reference

Key endpoints

A taste of the surface area. Customers, jobs, invoices, estimates, payments, inventory, scheduling, and notifications all expose full CRUD over JSON.

REST · /api/v1

Full CRUD over JSON, secured with your X-API-Key.

/customers/jobs/estimates /invoices/payments/inventory
Webhooks · 12 events

Register an endpoint and react in real time.

job.createdinvoice.paidpayment.received estimate.acceptedcustomer.created

Two ways to integrate — REST for read/write, webhooks for real-time push.

200 OK GET

/api/v1/customers

List all customers.

cursor-paginated
201 Created POST

/api/v1/customers

Create a new customer.

idempotency-key supported
200 OK GET

/api/v1/jobs

List jobs filtered by status or date.

sortable + filterable
201 Created POST

/api/v1/jobs

Schedule a new job. Fires job.created webhook.

audit-logged
200 OK GET

/api/v1/invoices

List invoices with pagination.

jurisdiction-aware
202 Accepted POST

/api/v1/invoices/:id/send

Send invoice via email or SMS. IRN auto-generated for IN.

retry-queue backed

A representative sample across customers · jobs · estimates · invoices · payments · inventory · procurement · scheduling · notifications. Every privileged call is audit-logged. View the full reference →

Global compliance · C7

5 jurisdictions, one API surface

Pass a country code, get the right tax math, the right document layout, the right e-invoice payload. Same endpoints, jurisdiction-aware behavior — no per-country forks in your integration code.

India GSTUS Sales TaxUK VATEU VATGCC VAT
IN IndiaCGST + SGST intra-state · IGST inter-state · IRN e-invoice (24h cancellation window) · HSN codes
UK United KingdomCIS withholding 20% / 30% / 0% (auto-deducted by registration status) · VAT returns
EU EU (SDI XML)Italian SDI XML e-invoice format · cross-border VAT routing · reverse-charge
SA KSA (ZATCA Phase 1)Bilingual Arabic/English · TLV QR code with 5 mandatory tags · VAT 15%
AE UAE / GCCVAT 5% · Arabic invoice support · FTA compliance fields
CA CanadaGST · HST · PST · QST routing by province · CRA-ready invoices
AU Australia10% GST · ABN withholding 49% (no-ABN supplier)
US United StatesState sales tax routing · destination/origin · resale certificate handling
Tax engine

Compliance math, automated

Pass intent — we compute the right tax breakdown. State changes, registration changes, jurisdiction toggles are all data, not code. Banking-grade isolation: each customer's data lives in its own logical vault — the database itself refuses to mix data across vaults, not just the app code.

Intra vs inter-state routing

Same supplier state as customer? CGST + SGST. Different? IGST. Computed from company.state vs customer.state.

India GST IRN e-invoice

Generates IRN + signed QR on POST. 24h cancellation window exposed via dedicated endpoint. HSN codes via lookup.

UK CIS deduction

Auto-deducts 20% / 30% / 0% based on contractor registration status, per subcontractor.

KSA ZATCA TLV QR

Phase 1 bilingual invoice + TLV QR encoding all 5 mandatory tags. Validates against ZATCA before render.

Auth

Authentication & security

Every request is authenticated with an API key sent in the X-API-Key header. Keys are created by your tenant admins, revocable at any time, and every privileged call is audit-logged.

API key ••••••••

Keys are shown once at creation and stored only as a hash — never in plaintext.

  • API-key authentication Send your secret key in the X-API-Key header on every request.
  • Created & revoked by your admins Generate and revoke keys under Settings → API keys. Revoking a key takes effect immediately.
  • Hashed at rest Only an irreversible hash of each key is stored — the raw key is displayed once, at creation.
  • Audit logging on every privileged call Who, when, from where, what changed — tamper-evident and visible to your tenant admins.
  • Available on the Scale tier Programmatic API access is included with Scale.
bash · Authenticate a request
curl https://api.servicesynchq.com/api/v1/customers \
  -H "X-API-Key: YOUR_API_KEY"

# 200 OK — returns your customers as JSON.
# Manage keys under Settings → API keys (admin only).
Webhooks · 12 events

React to every event in real time

Subscribe to lifecycle events across CRM, dispatch, billing, payments, procurement, and audit. Every webhook is cryptographically signed, retried with exponential backoff, and backed by a durable retry-queue.

job.created

New job created.

job.completed

Job marked complete.

job.status_changed

A job moved to a new status.

invoice.created

New invoice created.

invoice.paid

Invoice payment received.

invoice.overdue

Invoice crossed its due date unpaid.

payment.received

A customer payment was recorded.

customer.created

New customer added.

estimate.sent

Estimate sent to the customer.

estimate.accepted

Customer accepted the estimate.

estimate.rejected

Customer declined the estimate.

estimate.converted_to_job

Accepted estimate converted into a job.

SDKs

Client libraries — on the roadmap

Official SDKs are in development. Until they ship, the REST API is fully documented above and works with any HTTP client.

Node.js

Coming soon

Python

Coming soon

PHP

Coming soon

Ruby

Coming soon
Isolation

Tenant isolation, enforced at the database

Every request is automatically scoped to your workspace at the database layer — not just in application code. A query from one workspace literally cannot read another workspace's data — the database itself enforces it.

  • ✓ Isolation enforced at the database layer
  • ✓ Verified by an automated isolation test suite
  • ✓ Cross-tenant join attempts return empty, never error
  • ✓ Super-admin impersonation audit-logged
Business C Fully isolated Business B Fully isolated Business A Fully isolated POSTGRES · ROW-LEVEL SECURITY POLICIES
Rate limits

Generous, transparent, headers tell you

Fair-use rate limits with burst capacity. Your current limit and remaining quota come back on every response in X-RateLimit-Limit / X-RateLimit-Remaining / X-RateLimit-Reset headers (IETF draft standard). You'll never have to guess what's allowed.

Standard

Solo · Essentials · Growth

Included on every plan with API access.

Generous defaults

Enough headroom for ordinary integrations · headers tell you in real time

Enterprise

Scale + Enterprise add-on

Custom ceilings, dedicated capacity, SLAs.

Custom

Contact sales for sizing

When you hit a limit: you'll get an HTTP 429 Too Many Requests with a Retry-After header in seconds. Our SDKs handle this automatically with exponential backoff. If you regularly need higher ceilings, talk to us — the published numbers are floors, not ceilings.
Security

Your API keys, treated like the secrets they are

We protect your keys the way we'd want our own protected. Here's what you can count on.

TLS only, everywhere

Every request to the API is encrypted in transit with modern TLS. Plain HTTP is refused at the edge.

Tenant-scoped by design

Every API key is bound to one workspace. There is no path that lets a key from workspace A read data from workspace B — enforced at the database layer, not just the application.

Audit log on every privileged call

Who, when, from where, what changed. Tamper-evident and tenant-readable. Perfect for compliance reviews. Read more on the security page.

Instant key revocation

Suspect a leak? Revoke the key in the admin panel and it stops working immediately. Issue a fresh key and update your integration.

Hashed at rest

Only an irreversible hash of each key is stored. The raw key is shown once, at creation, and never persisted in plaintext.

Audit trail on every call

Every privileged API action is recorded — who, when, from where, what changed — in a tamper-evident log your admins can review.

Best practices for protecting your API keys

Never commit keys to git Use environment variables or a secrets manager. If you do leak one, rotate it in our admin panel before pushing the fix.
Call the API from your backend Keep keys server-side — never expose them in a browser or mobile app.
Rotate quarterly Or any time someone with key access leaves your team.
One key per integration A separate key per integration means you can revoke just one if it leaks.
Store keys in a secrets manager Environment variables or a vault — not source control, not a shared doc.
Watch the audit log An unfamiliar IP using your key is a signal worth investigating.

Ready to build?

API access is included on the Scale tier. Read the docs first, get your keys when you're ready.