workwing-io OAuth API

openapi: 3.2.0
info:
  title: WorkWing OAuth API
  description: 'REST API for WorkWing field service management. Designed as an **integration point** for CRM, ERP, and dispatch systems. Admin configuration (webhooks, roles, job types, integrations) is managed via the web dashboard. Every resource is documented under its own section in the sidebar. ## Authentication


    Send your API key as a bearer token on every request:


    ```

    Authorization: Bearer ww_sk_live_. ```


    ### Scopes


    An API key carries a list of `action:resource` scopes. Every operation publishes the ones it requires as `x-required-scopes`, an array on the operation object; a key must hold all of them, or the wildcard scope `*`, and one that does not is refused with `403 E_AP_1102`. The two operations that declare `security: []` need no key at all: the health check, and the integration callback, which authenticates with the signed token in its own path. ## Querying collections


    List endpoints (jobs, customers, resources, and so on) accept query parameters for filtering, sorting, field selection, and pagination:


    - `?status=eq.T_PENDING` - filter by exact match

    - `?priority=in.(T_HIGH,T_URGENT)` - match any of several values

    - `?created_at=gte.2024-01-01` - range comparisons (`gt`, `gte`, `lt`, `lte`)

    - `?select=id,status,customer:customers(name)` - choose columns and embed related records. Only the resources listed here, the assignments and users they reference, and the foreign keys between them can be embedded; anything else is refused with `E_AP_6003`

    - `?order=created_at.desc` - sort (append `.asc` / `.desc`)

    - `?limit=25&offset=50` - paginate (maximum 1000 rows per page)


    ### Columns not available over the API


    Some columns are never returned: `tenant_id` on every resource (a key is bound to one tenant), `internal_notes` on jobs (staff-only; it can be set with `PATCH`, and a job''s note timeline is at `GET /v1/jobs/{jobId}/notes`), and the raw PostGIS geography columns `customers.location`, `locations.location` and `resources.current_location`. Read a position from `latitude`/`longitude` on locations and `current_latitude`/`current_longitude` on resources instead. `select=*`, at the top level or inside an embed, returns every other column. Naming one of these columns in `select`, a filter or `order` is refused with `E_AP_6003`. To read, update or delete one record, address it by id: `GET`, `PATCH` or `DELETE /v1/jobs/{jobId}` (likewise customers, resources and locations). `PATCH` and `DELETE` on a collection change every row matching its filters, e.g. `PATCH /v1/jobs?status=eq.T_PENDING`; they are listed under Workflows. ### Counting and paging


    Send `Prefer: count=exact` on a list request to get the total row count back in the `Content-Range` response header (`0-24/312`). `count=planned` and `count=estimated` are cheaper approximations for large tables. ## Idempotency


    **Guarantee.** Within 24 hours, a write sent with a given `Idempotency-Key` is applied at most once. If you did not receive a response, retrying with the same key and the same request is always safe. **Core rule.** A key is consumed only when the write is actually applied. The key and the write commit in the same database transaction, so they succeed or fail together. Every write request (`POST`, `PATCH`, `PUT`, `DELETE`) must send an `Idempotency-Key` header. | Situation | Response | Write applied?'
  version: 1.0.0
servers:
- url: https://api.workwing.io
  description: Production
security:
- bearerAuth: []
tags:
- name: OAuth
  description: OAuth connection management
paths:
  /v1/oauth/connections:
    get:
      operationId: listOAuthConnections
      summary: List OAuth connections
      tags:
      - OAuth
      description: List all OAuth connections for the current brand.
      security:
      - bearerAuth: []
      x-required-scopes:
      - read:integrations
      responses:
        '200':
          description: Default Response
          content:
            application/json:
              schema:
                type: object
                required:
                - data
                - meta
                properties:
                  data:
                    type: array
                    items:
                      type: object
                      required:
                      - id
                      - provider
                      - status
                      - scopes
                      - tokenExpiresAt
                      - connectedAt
                      - lastRefreshedAt
                      - providerMetadata
                      properties:
                        id:
                          type: string
                          format: uuid
                        provider:
                          type: string
                        status:
                          type: string
                        scopes:
                          type:
                          - array
                          - 'null'
                          items:
                            type: string
                          description: OAuth scopes granted by the provider
                        tokenExpiresAt:
                          type:
                          - string
                          - 'null'
                          format: date-time
                          description: When the current access token expires
                        connectedAt:
                          type:
                          - string
                          - 'null'
                          format: date-time
                        lastRefreshedAt:
                          type:
                          - string
                          - 'null'
                          format: date-time
                        providerMetadata:
                          type:
                          - object
                          - 'null'
                          additionalProperties: true
                          description: Provider-specific details recorded when the account was connected
                  meta:
                    type: object
                    required:
                    - request_id
                    - timestamp
                    properties:
                      request_id:
                        type: string
                      timestamp:
                        type: string
                        format: date-time
components:
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer
      bearerFormat: API Key
      description: 'Use your WorkWing API key (format: `ww_sk_live_<tokenId>.<secret>`). The scopes an operation requires are published on it as `x-required-scopes`.'