API Keys & Scopes

API access is managed per API client. An API client belongs to one organization, has a set of permissions (scopes) and one or more API keys.

#Creating an API client

1. In the WorkLogx web app, open Integrations → WorkLogx API.
2. Click Create API access, enter a name (for example "ERP sync") and select the permissions.
3. Copy the key. It is shown only once.

Every request made with the key only sees and changes data of the organization that owns the API client.

#Managing keys

Under Manage for an API client you can:

• Create new key: issues an additional key. Existing keys remain active until revoked.
• Revoke a key: the revoked key can no longer be used. Other keys remain active.
• Disable or Enable the API client: requests with keys of a disabled client fail with 403 api_client_disabled.
• Change the permissions of the API client.

To rotate a key without downtime: create a new key, switch your integration to it, then revoke the old key.

#Scopes in V1

Each endpoint requires exactly one scope. Read scopes allow GET, write scopes allow POST and PATCH.

A write scope does not include the read scope. If your integration creates customers and reads them back, select both customers:read and customers:write.

If the scope is missing, the API answers with 403 insufficient_scope and names the required scope:

{
  "type": "https://api.worklogx.com/problems/insufficient-scope",
  "title": "Insufficient scope",
  "status": 403,
  "code": "insufficient_scope",
  "requestId": "0f9a3c2e-5b71-4d2a-9c4e-8e1f6a7b2d10",
  "requiredScope": "customers:write"
}

Select only the scopes an integration needs.