GET /v1/admin/api-keys
The business's API keys Owners only. Every key, live and revoked, newest first; a key's secret is never listed.
Response 200 · object Done.
api_keysarray of ApiKey, required
idinteger (int64), required
namestring, required
prefixstring, required
permissionsarray of string, required
created_byinteger (int64) or null, required
created_by_namestring, required
created_atstring, required
last_used_atstring or null, required
revoked_atstring or null, required
revoked_byinteger (int64) or null, required
Example response 200 {
"api_keys": [
{
"id": 0,
"name": "string",
"prefix": "string",
"permissions": [
"string"
],
"created_by": 0,
"created_by_name": "string",
"created_at": "string",
"last_used_at": "string",
"revoked_at": "string",
"revoked_by": 0
}
]
} Response 401 · Error No tenant key, or no valid session.
errorobject, required
codestring, required A short machine-readable name, such as not_found.
messagestring, required What went wrong, for people.
request_idstring, required Matches the X-Request-ID response header.
Example response 401 {
"error": {
"code": "string",
"message": "string"
},
"request_id": "string"
}POST /v1/admin/api-keys
Create an API key Owners only. A key a business's own system sends as a bearer token with the tenant key; it acts as its own record with only its permissions, and is refused on routes for the signed-in person. The name is 1 to 80 characters, unique among live keys; the permissions are at least one, never staff.manage, roles.manage, settings.write, payments.manage, accounting.manage or drivers.pair. At most 20 live keys (409). token is the key, shown this once. Every Owner is emailed.
Request body · object namestring, required
permissionsarray of string, required
Example request {
"name": "string",
"permissions": [
"string"
]
} Response 200 · object Created.
keyApiKey, required An API key as Owners see it. prefix is its first 12 characters; times are UTC.
idinteger (int64), required
namestring, required
prefixstring, required
permissionsarray of string, required
created_byinteger (int64) or null, required
created_by_namestring, required
created_atstring, required
last_used_atstring or null, required
revoked_atstring or null, required
revoked_byinteger (int64) or null, required
tokenstring, required
Example response 200 {
"key": {
"id": 0,
"name": "string",
"prefix": "string",
"permissions": [
"string"
],
"created_by": 0,
"created_by_name": "string",
"created_at": "string",
"last_used_at": "string",
"revoked_at": "string",
"revoked_by": 0
},
"token": "string"
}DELETE /v1/admin/api-keys/{id}
Revoke an API key Owners only. The key is refused from its next request and stays listed as revoked. A revoked or unknown key is 404.
Parameters idstring, in the path, required Response 200 · object Done.
Example response 200 {
"message": "string"
}GET /v1/admin/me
The signed-in staff member Any signed-in staff member; an API key is refused (403).
Response 200 · object Done.
userStaffMember, required
idinteger (int64)
first_namestring, required
last_namestring, required
emailstring Empty for a driver.
phonestring
statusstring One of: invited active removed
ownerboolean, required Whether the staff member holds the Owner role.
Example response 200 {
"user": {
"id": 0,
"first_name": "string",
"last_name": "string",
"email": "string",
"phone": "string",
"status": "invited"
},
"owner": true
}POST /v1/admin/invitations
Invite a staff member Needs the staff.manage permission.
Request body · object idinteger (int64)
first_namestring, required
last_namestring, required
emailstring Empty for a driver.
phonestring
statusstring One of: invited active removed
role_idsarray of integer (int64)
Example request {
"id": 0,
"first_name": "string",
"last_name": "string",
"email": "string",
"phone": "string",
"status": "invited",
"role_ids": [
0
]
} Response 200 · object Done.
messagestring, required
admin_idinteger (int64), required
Example response 200 {
"message": "string",
"admin_id": 0
}GET /v1/admin/users
The staff Any signed-in staff member. Removed staff are left out.
Response 200 · object Done.
usersarray of object, required
idinteger (int64)
first_namestring, required
last_namestring, required
emailstring Empty for a driver.
phonestring
statusstring One of: invited active removed
role_idsarray of integer (int64), required
Example response 200 {
"users": [
{
"id": 0,
"first_name": "string",
"last_name": "string",
"email": "string",
"phone": "string",
"status": "invited",
"role_ids": [
0
]
}
]
}GET /v1/admin/user/{user_id}
A staff member Any signed-in staff member.
Parameters user_idstring, in the path, required Response 200 · object Done.
userStaffMember, required
idinteger (int64)
first_namestring, required
last_namestring, required
emailstring Empty for a driver.
phonestring
statusstring One of: invited active removed
Example response 200 {
"user": {
"id": 0,
"first_name": "string",
"last_name": "string",
"email": "string",
"phone": "string",
"status": "invited"
}
}PUT /v1/admin/user/{user_id}
Change a staff member Needs the staff.manage permission. A staff member can change their own details without staff.manage. Only an Owner can change another Owner.
Parameters user_idstring, in the path, required Request body · StaffMember idinteger (int64)
first_namestring, required
last_namestring, required
emailstring Empty for a driver.
phonestring
statusstring One of: invited active removed
Example request {
"id": 0,
"first_name": "string",
"last_name": "string",
"email": "string",
"phone": "string",
"status": "invited"
} Response 200 · Message Done.
Example response 200 {
"message": "string"
}DELETE /v1/admin/user/{user_id}
Remove a staff member Needs the staff.manage permission.
Parameters user_idstring, in the path, required PUT /v1/admin/user/{user_id}/password
Change your own password Any signed-in staff member.
Parameters user_idstring, in the path, required Request body · object old_passwordstring, required
new_passwordstring, required
new_password_confirmstring, required
Example request {
"old_password": "string",
"new_password": "string",
"new_password_confirm": "string"
}POST /v1/admin/clock
Add a clock event by hand Needs the hours.write permission. For the job's driver or a crew member (anyone else is 400), with a note saying why; marked as the office's, with who added it. Publishes job.updated.
Request body · object job_idinteger (int64), required
staff_idinteger (int64), required
kindstring, required One of: in out
happened_atstring, required RFC 3339.
notestring, required 1 to 500 characters.
Example request {
"job_id": 0,
"staff_id": 0,
"kind": "in",
"happened_at": "string",
"note": "string"
} Response 200 · object Done.
clock_eventClockEvent, required A person clocked in or out on a job, from its driver's phone or by the office. A voided event stays but adds no hours. Times as for JobStep.
idinteger (int64), required
client_idstring, required
job_idinteger (int64), required
staff_idinteger (int64), required
kindstring, required One of: in out
driver_idinteger (int64) or null, required
happened_atstring, required
received_atstring, required
sourcestring, required One of: phone office
added_byinteger (int64) or null, required The staff member who added an office event.
notestring or null, required Why the office added it.
replaces_idinteger (int64) or null, required The event an office fix voided.
voided_atstring or null, required
voided_byinteger (int64) or null, required
void_reasonstring or null, required
Example response 200 {
"clock_event": {
"id": 0,
"client_id": "string",
"job_id": 0,
"staff_id": 0,
"kind": "in",
"driver_id": 0,
"happened_at": "string",
"received_at": "string",
"source": "phone",
"added_by": 0,
"note": "string",
"replaces_id": 0,
"voided_at": "string",
"voided_by": 0,
"void_reason": "string"
}
}PUT /v1/admin/clock/{id}
Fix a clock event Needs the hours.write permission. Voids the event with the reason and adds an office event in its place for the same job and person, with the kind and time given and the reason as its note. Gives the new event, whose replaces_id is the voided one. A voided event can't be fixed (409); a person no longer on the job can't be clocked (400). Publishes job.updated.
Parameters idstring, in the path, required Request body · object kindstring, required One of: in out
happened_atstring, required RFC 3339.
reasonstring, required 1 to 500 characters.
Example request {
"kind": "in",
"happened_at": "string",
"reason": "string"
} Response 200 · object Done.
clock_eventClockEvent, required A person clocked in or out on a job, from its driver's phone or by the office. A voided event stays but adds no hours. Times as for JobStep.
idinteger (int64), required
client_idstring, required
job_idinteger (int64), required
staff_idinteger (int64), required
kindstring, required One of: in out
driver_idinteger (int64) or null, required
happened_atstring, required
received_atstring, required
sourcestring, required One of: phone office
added_byinteger (int64) or null, required The staff member who added an office event.
notestring or null, required Why the office added it.
replaces_idinteger (int64) or null, required The event an office fix voided.
voided_atstring or null, required
voided_byinteger (int64) or null, required
void_reasonstring or null, required
Example response 200 {
"clock_event": {
"id": 0,
"client_id": "string",
"job_id": 0,
"staff_id": 0,
"kind": "in",
"driver_id": 0,
"happened_at": "string",
"received_at": "string",
"source": "phone",
"added_by": 0,
"note": "string",
"replaces_id": 0,
"voided_at": "string",
"voided_by": 0,
"void_reason": "string"
}
}POST /v1/admin/clock/{id}/void
Void a clock event Needs the hours.write permission. The event stays, with who voided it, when and why, and adds no hours. Voiding twice is 409. Publishes job.updated.
Parameters idstring, in the path, required Request body · object reasonstring, required 1 to 500 characters.
Example request {
"reason": "string"
} Response 200 · object Done.
clock_eventClockEvent, required A person clocked in or out on a job, from its driver's phone or by the office. A voided event stays but adds no hours. Times as for JobStep.
idinteger (int64), required
client_idstring, required
job_idinteger (int64), required
staff_idinteger (int64), required
kindstring, required One of: in out
driver_idinteger (int64) or null, required
happened_atstring, required
received_atstring, required
sourcestring, required One of: phone office
added_byinteger (int64) or null, required The staff member who added an office event.
notestring or null, required Why the office added it.
replaces_idinteger (int64) or null, required The event an office fix voided.
voided_atstring or null, required
voided_byinteger (int64) or null, required
void_reasonstring or null, required
Example response 200 {
"clock_event": {
"id": 0,
"client_id": "string",
"job_id": 0,
"staff_id": 0,
"kind": "in",
"driver_id": 0,
"happened_at": "string",
"received_at": "string",
"source": "phone",
"added_by": 0,
"note": "string",
"replaces_id": 0,
"voided_at": "string",
"voided_by": 0,
"void_reason": "string"
}
}GET /v1/admin/hours
Hours staff clocked Needs the hours.read permission. Voided clock events are left out. One row for each person with clock events on each of the business's days from from to to, at most 62 days, by date then name. Each in is matched with the next out by the phone's time; a period belongs to the day of its in.
Parameters fromstring, in the query, required First day, YYYY-MM-DD.
tostring, in the query, required Last day, YYYY-MM-DD.
Response 200 · object Done.
hoursarray of Hours, required
staff_idinteger (int64), required
first_namestring, required
last_namestring, required
datestring, required YYYY-MM-DD.
minutesinteger, required
periodsarray of object, required
stray_outsinteger, required
eventsarray of ClockEvent, required The clock events counted on the day, in order, each period's on the day of its in.
idinteger (int64), required
client_idstring, required
job_idinteger (int64), required
staff_idinteger (int64), required
kindstring, required One of: in out
driver_idinteger (int64) or null, required
happened_atstring, required
received_atstring, required
sourcestring, required One of: phone office
added_byinteger (int64) or null, required The staff member who added an office event.
notestring or null, required Why the office added it.
replaces_idinteger (int64) or null, required The event an office fix voided.
voided_atstring or null, required
voided_byinteger (int64) or null, required
void_reasonstring or null, required
Example response 200 {
"hours": [
{
"staff_id": 0,
"first_name": "string",
"last_name": "string",
"date": "string",
"minutes": 0,
"periods": [
{
"in": "string",
"out": "string"
}
],
"stray_outs": 0,
"events": [
{
"id": 0,
"client_id": "string",
"job_id": 0,
"staff_id": 0,
"kind": "in",
"driver_id": 0,
"happened_at": "string",
"received_at": "string",
"source": "phone",
"added_by": 0,
"note": "string",
"replaces_id": 0,
"voided_at": "string",
"voided_by": 0,
"void_reason": "string"
}
]
}
]
}