Examples

Copy-paste, working requests. BASE = https://<workspace>.corteksa.com/api/v1. KEY is an API key (crtk_live_…); TOKEN is an OAuth access token (crtk_oauth_…). Either credential works on every endpoint below.

Validate a credential — `GET /me`

Confirm a pasted key and greet the workspace by name. /me needs no scope — any valid credential can call it.

cURL (X-Api-Key)

curl "$BASE/me" -H "X-Api-Key: $KEY"

cURL (Bearer — API key or OAuth token)

curl "$BASE/me" -H "Authorization: Bearer $KEY"

200

{
  "message": "Success",
  "data": {
    "workspace_name": "Acme Sales",
    "workspace_id": 42,
    "tenant_type": "hyper",
    "scopes": ["read.contacts", "create.contacts", "update.contacts"]
  }
}

A 401 means the credential is missing, invalid, revoked, or expired.

Make a scoped call — read records

Requires scope read.contacts. :objectSlug (contacts) is a workspace object; confirm slugs per customer (schemas are customizable).

curl "$BASE/object/data/contacts?page=1&limit=25" \
  -H "X-Api-Key: $KEY"

JavaScript (fetch)

const res = await fetch(`${BASE}/object/data/contacts?page=1&limit=25`, {
  headers: { 'X-Api-Key': key },
});
if (res.status === 401) throw new Error('reconnect'); // key invalid/revoked
if (res.status === 403) throw new Error('missing read.contacts scope');
const { data, pagination } = await res.json();

Discover objects & fields

Let the user pick what to sync and map fields. /object/active needs no scope; listing a specific object's fields needs read.{objectSlug}.

# pickable objects (slug, name, icon)
curl "$BASE/object/active" -H "X-Api-Key: $KEY"

# an object's fields (slug, name, type) — use the field slugs to write
curl "$BASE/object/field/active/contacts" -H "X-Api-Key: $KEY"

Create a record

Requires scope create.contacts. Keys in data are field slugs — read them from GET /object/field/active/:objectSlug above.

curl -X POST "$BASE/object/data/contacts" \
  -H "X-Api-Key: $KEY" \
  -H "Content-Type: application/json" \
  -d '{ "data": { "name": "Sara", "phone-a1b2c3": "+201234567890" } }'

await fetch(`${BASE}/object/data/contacts`, {
  method: 'POST',
  headers: { 'X-Api-Key': key, 'Content-Type': 'application/json' },
  body: JSON.stringify({ data: { name: 'Sara', 'phone-a1b2c3': '+20…' } }),
});

The OAuth "Connect" exchange

The partner backend side of "Connect with Corteksa" (the browser only sees the consent screen). PKCE for public clients, client_secret for confidential.

1. Send the user to the consent screen (the Corteksa web app, on the workspace subdomain — not the API):

https://<workspace>.corteksa.com/en/oauth/authorize
    ?client_id=crtk_app_abc123
    &redirect_uri=https://your-app.com/callback   (exact match, URL-encoded)
    &scope=read.contacts%20create.contacts
    &state=<random-opaque-string>
    &response_type=code
    &code_challenge=<S256>&code_challenge_method=S256   (public clients)

2. User approves → the browser returns to your redirect_uri with ?code=…&state=…. Verify state. The code is single-use and expires in 60s.

3. Exchange the code for tokens (server-to-server). This endpoint returns raw RFC 6749 JSON — no app envelope:

curl -X POST "$BASE/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "authorization_code",
    "code": "<code>",
    "redirect_uri": "https://your-app.com/callback",
    "client_id": "crtk_app_abc123",
    "client_secret": "crtk_secret_…"
  }'

200

{
  "access_token": "crtk_oauth_…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "crtk_refresh_…",
  "scope": "read.contacts create.contacts"
}

4. Call the API with the access token:

curl "$BASE/object/data/contacts" \
  -H "Authorization: Bearer crtk_oauth_…"

5. Refresh (access tokens last ~1h; the refresh_token rotates — persist the new one each time):

curl -X POST "$BASE/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "grant_type": "refresh_token",
    "refresh_token": "crtk_refresh_…",
    "client_id": "crtk_app_abc123",
    "client_secret": "crtk_secret_…"
  }'

Get pushed a signed POST on every record change instead of polling. Full payload, headers, and the signature-verification recipe live in Webhooks.

curl -X POST "$BASE/webhooks/subscriptions" \
  -H "Authorization: Bearer $KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "object_slug": "contacts",
    "events": ["record.created", "record.updated"],
    "target_url": "https://api.your-app.com/corteksa/webhook"
  }'

The response returns the signing_secret once — store it now.

Every endpoint → REST API
When a call fails → Troubleshooting
Do it safely → Best Practices

Examples

Validate a credential — `GET /me`

Make a scoped call — read records

Discover objects & fields

Create a record

The OAuth "Connect" exchange

Next

On this page

Examples

Validate a credential — GET /me

Make a scoped call — read records

Discover objects & fields

Create a record

The OAuth "Connect" exchange

Subscribe to a webhook

Next

On this page

Validate a credential — `GET /me`