REST API

Overview

Smart Business 360 exposes a REST API used by the mobile application (JWT Bearer authentication) and supports company-scoped API keys for external integrations. Webhooks exist for inbox and attendance-style events.

Prerequisites

• Company administrator or partner agreement for API access
• Understanding of JWT Bearer tokens for mobile clients
• Secure storage for company-scoped API keys — never embed keys in public documentation

Supported functionality

• Mobile REST API with JWT authentication
• Company-scoped API keys for external access
• Webhooks for selected integration events (inbox, attendance-style flows)
• Partner access arranged through Smart Business 360 support

Setup

1. Contact Smart Business 360 support or your tenant administrator for API entitlement.
2. Provision company-scoped API keys through administrative settings when available.
3. For mobile apps, authenticate with JWT Bearer tokens using the mobile auth flow.
4. Configure webhook endpoints only using URLs and secrets shown in-app — do not invent callback paths here.

Contact support for API access

Configuration

Store API keys in secure integration settings. Rotate keys when staff leave or integrations change. Scope keys to a single company tenant.

Connection verification

1. Call a known read endpoint permitted for your key or token.
2. Confirm responses are company-scoped to the intended tenant.
3. Review application activity logs if calls are rejected.

Usage

Use the mobile API for authenticated app clients. Use company API keys for approved server-to-server integrations. Do not share keys across companies.

Troubleshooting

• 401 Unauthorized — token expired or key invalid; re-authenticate or regenerate keys.
• 403 Forbidden — key lacks permission for the module/action.
• Missing endpoint docs — request partner documentation from support; none is invented here.

FAQ

Related articles

• Integrations Overview
• Security
• Roles & Permissions