Integration API Reference — endpoints reachable with a key
Integrations — Integration API Reference — endpoints reachable with a key
The main endpoints an API key (crtk_live_…) or OAuth token (crtk_oauth_…)
can reach: identity, schema discovery, records and webhooks. Object, field, tag
and file endpoints also accept these credentials; the
API reference lists every endpoint a credential can
reach, with its request and response.
Base URL & auth
Use app as the subdomain for a shared workspace, or the workspace's own
subdomain for a dedicated one — see
Connect with Corteksa.
Send the credential either way — both are accepted:
Most routes below are gated by the credential's scopes (route-name strings).
A call outside the granted scopes returns 403; an invalid/revoked/expired
credential returns 401. :objectSlug is an object (e.g. contacts, deals);
:dataSlug and :recordSlug are a record's slug.
Identity
| Method | Path | Scope | Purpose |
|---|---|---|---|
GET | /me | (none) | Validate the credential; returns the bound workspace name, id, tenant type, and granted scopes. Use it to confirm a pasted key and show "Connected to <Workspace>". |
Discovery — objects & fields
Read-only schema, so an app can let the user pick what to sync and map fields.
| Method | Path | Scope | Purpose |
|---|---|---|---|
GET | /object/active | (none) | List the workspace's active objects (slug, name, icon) — the pickable sync targets. |
GET | /object/field/active/:objectSlug | read.{objectSlug} | List an object's fields (slug, name, type) to map onto. |
Write bodies are keyed by field slug — discovery returns both
slugandname; map your app's fields to the fieldslugfor writes.
Records — read
All require scope read.{objectSlug}.
| Method | Path | Purpose |
|---|---|---|
GET | /object/data/:objectSlug | List/paginate records of an object |
GET | /object/data/:objectSlug/:dataSlug | Fetch one record |
POST | /object/data/:objectSlug/search | Free-text search (searchTerm in the body) |
GET | /object/data/:objectSlug/lookup | Slug and name pairs, for pickers |
GET | /object/data/facets/:objectSlug | Facet/aggregate counts |
GET | /object/data/:objectSlug/field-options/:fieldSlug | Allowed values for a field |
GET | /object/data/select-options/:objectSlug/:fieldSlug | Select-field options |
POST | /object/data/:objectSlug/column-values/:fieldSlug | The values a field holds across records |
POST | /object/data/:objectSlug/signals | Open tasks, overdue items, mentions and unread messages per record |
GET | /object/data/duplicates/:objectSlug/:fieldSlug | Records that share a value in one field |
GET | /object/data/:objectSlug/:dataSlug/relations/:relationSlug | Related records for one record |
GET | /object/data/:objectSlug/:dataSlug/logs | A record's change log |
GET | /object/data/:objectSlug/:dataSlug/activity | A record's activity trail, a page at a time, when the feature is on |
Records — write
| Method | Path | Scope | Purpose |
|---|---|---|---|
POST | /object/data/:objectSlug | create.{objectSlug} | Create a record |
POST | /object/data/:objectSlug/inline | create.{objectSlug} | Create a record from a board column or table row |
POST | /object/data/:objectSlug/:recordSlug/duplicate | create.{objectSlug} | Copy a record, when the feature is on |
POST | /object/data/:objectSlug/bulk-duplicate | create.{objectSlug} | Copy many records, when the feature is on |
PUT | /object/data/:objectSlug/:dataSlug | update.{objectSlug} | Update a record |
PATCH | /object/data/:objectSlug/:recordSlug/position | update.{objectSlug} | Set a record's manual board order |
POST | /object/data/:objectSlug/bulk-update | update.{objectSlug} | Update many records |
POST | /object/data/:objectSlug/bulk-actions | update.{objectSlug} | Run update, assign or delete on many records |
GET | /object/data/:objectSlug/bulk-actions/:jobId | update.{objectSlug} | Report on a background bulk action |
POST | /object/data/:objectSlug/bulk-actions/:jobId/cancel | update.{objectSlug} | Stop a background bulk action |
PATCH | /object/data/:objectSlug/:recordSlug/assignees | assign.{objectSlug} | Set a record's assignees |
POST | /object/data/:objectSlug/bulk-assign | assign.{objectSlug} | Reassign many records |
DELETE | /object/data/:objectSlug/:dataSlug | delete.{objectSlug} | Delete a record |
POST | /object/data/:objectSlug/bulk-delete | delete.{objectSlug} | Delete a list of records |
DELETE | /object/data/:objectSlug/bulk/all | delete.{objectSlug} | Delete all matching records |
Write bodies are keyed by field slug. e.g.
{ "data": { "name-8fk2": "Sara", "phone-p0zx": "+20…" } }.
Webhooks — push
Instead of polling, subscribe an HTTPS endpoint and Corteksa pushes an
HMAC-signed POST when a record is created, updated or deleted. Subscriptions
are owned by the credential that creates them. Full guide:
Webhooks. Payloads, headers and signature
verification: Webhook events.
| Method | Path | Purpose |
|---|---|---|
GET | /webhooks/events | List subscribable event names (record.created …) |
POST | /webhooks/subscriptions | Create a subscription (returns the signing secret once) |
GET | /webhooks/subscriptions | List your subscriptions |
GET | /webhooks/subscriptions/:slug | Fetch one |
DELETE | /webhooks/subscriptions/:slug | Delete one |
Creating a subscription requires
read.{object_slug}— a webhook can only carry data the credential could already read. These endpoints accept an API key or an OAuth token; a user session (JWT) is rejected with403.
What's covered today
- Identity —
GET /me - Discovery — list active objects + an object's fields (to build a field mapping)
- Records — read and write on any object, scoped per object and action
- Webhooks — subscribe to
record.created/updated/deleted, HMAC-signed, per object (needsread.{object}) - Objects, fields, tags and files — listed in the API reference
Not reachable with a key (human-only, by design): admin/roles, billing, user management, workspace settings, and the key/OAuth-app management endpoints.
Coming later
New endpoints are added under the same model — a crtk_live_/crtk_oauth_
credential + route-name scopes. Anything not in the
API reference is not available to integrations, even
if it exists in the app. Every change to what a credential can reach is dated in
the API changelog.