REST API & outbound webhooks
- NewA REST API on Enterprise. Read your schedule, staff, credentials, open shifts and on-call chain from anything else you run. Keys are created and revoked in the app, shown once, and stored as a hash; revoking one takes effect on the next request, with no cache to wait out.
- NewOutbound webhooks. We POST a signed body the moment a shift is claimed, a swap is approved, or an on-call board is published or taken down: HMAC-SHA256 over the raw body, with an event id you can dedupe on. Failed deliveries retry with backoff, and every attempt is listed in the app with the status code your server returned.
- ImprovedHours over the API are computed the same way the payroll export computes them: real elapsed time between two instants. The night your clocks go back reads as thirteen hours there too.
