OnworkDevelopers

Changelog

Every change to the Onwork public API, newest first. Within a version all changes are additive — see Versioning & deprecation.

2026-07 — Absences & Expenses (read-only)

Endpoints

  • GET /v1/absences + GET /v1/absences/{id} — the company's leave requests (day, type, hours, lifecycle status). Free-text notes, reasons and attachments are not exposed. Filters: employee_id, status, date_from/date_to, updated_since.
  • GET /v1/expenses + GET /v1/expenses/{id} — project expenses (employee, project, category, description, amount, date). Pricing internals, km/ per-diem detail and attachments are not exposed. Filters: employee_id, project_id, category, date_from/date_to, updated_since.

Scopes

  • absences:read, expenses:read (Projects)

Events

  • absences.created / absences.updated / absences.deleted
  • expenses.created / expenses.updated / expenses.deleted

2026-07 — Employees, Roles & user provisioning

Endpoints

  • GET /v1/employees + GET /v1/employees/{id} — the company's employees (HR profile: identifiers, contract, hire dates, job title, supervisor). Payroll (salary), bank data, HR documents and photos are never exposed. Name/email live on the linked user (user_id).
  • GET /v1/roles + GET /v1/roles/{id} — the company's roles and the permissions they grant.
  • POST /v1/users — provision a new user (assign to the company, optional roles, optional invite email).
  • POST /v1/users/{id}/deactivate + /activate — enable/disable a user's login (only for users exclusive to this company).

Scopes

  • employees:read, roles:read (Core)
  • users:write (Core)

Events

  • employees.created / employees.updated / employees.deleted

2026-07 — Company

Endpoints

  • GET /v1/company — the authenticated tenant's own company profile (identity data only). No list endpoint and no by-id lookup: an integration can only ever see its own company.

Scopes

  • company:read (Core module)

Events

  • company.updated

2026-07 — Webhooks

Signed event deliveries pushed to your HTTPS endpoint — no polling.

Platform

  • Webhook endpoints with per-event subscriptions, managed from company settings; HMAC-SHA256 signatures (X-Onwork-Signature), automatic retries with exponential backoff, auto-disable after repeated failures.
  • Event payloads are rendered through the same resource models as the REST API (data = the resource, same shape as the corresponding GET).

Events

  • users.created / users.updated / users.deleted
  • projects.created / projects.updated / projects.deleted
  • shifts.created / shifts.updated / shifts.deleted

See the Webhooks guide for the envelope, signature verification and retry semantics.

2026-07 — Projects & Shifts (read-only)

Endpoints

  • GET /v1/projects — list the company's projects (filters: status, kind, customer_id, updated_since; paginated).
  • GET /v1/projects/{id} — fetch a single project.
  • GET /v1/shifts — list work shifts (filters: employee_id, project_id, status, date_from/date_to, updated_since; paginated).
  • GET /v1/shifts/{id} — fetch a single shift.

Scopes

  • projects:read (Projects module)
  • shifts:read (Projects module)

Project resources expose registry data only — commercial details (offer/order numbers, CIG/CUP codes, managers, notes, pricing) are not part of the public contract. Shift resources expose structural data only — free-text content and billing internals stay private.

2026-07 — Initial release (v1)

The first public release of the Onwork API.

Platform

  • Tenant API keys (owk_...) with per-key scopes, optional expiration, instant revocation and a management UI in company settings.
  • Authentication via X-Api-Key or Authorization: Bearer.
  • Uniform error envelope (error.code / message / status / details).
  • Rate limiting with Retry-After and X-RateLimit-* headers.
  • Idempotent retries via the Idempotency-Key header (Bearer auth).
  • Interactive reference generated from the live OpenAPI specification.

Endpoints

  • GET /v1/users — list the company's users (filters: active, email, updated_since; paginated).
  • GET /v1/users/{id} — fetch a single user.

Scopes

  • users:read

Coming next

  • Employees, absences and shifts resources.
  • Outbound webhooks with HMAC-signed deliveries.