API Integrations Overview

API Integrations Overview

Authentication

An integration authenticates with an API key, created from Integrations & API Keys and sent as Authorization: Bearer ....

Requests made from the Admin Center in a browser are authenticated by the session cookie instead, which is why the reference works when you are signed in. Logging in does not issue a bearer token, so anything calling the API from outside the Admin Center needs a key of its own.

Keeping an API key secret

An API key is shown once, when you create it, and cannot be retrieved afterwards: the key list only ever returns a masked value. Copy it straight into secret storage, and if you lose it, create a replacement rather than trying to recover it.

A key carries the permissions of the tenant it was created for, so treat it the way you would a password:

• Keep it server-side, in your platform's secret storage or an environment variable that is not committed to version control.
• Never ship it in a browser, a mobile app, or anything else running on someone else's device. Anything sent to a client can be read by that client, so call the API from your own backend and let that backend hold the key.
• Rotate by creating the new key first and deleting the old one once traffic has moved across. Deleting a key revokes it immediately, so any integration still using it starts failing at once.

What The API Covers

The /docs/api/v1 reference is generated from the OpenAPI files and documents endpoints for areas such as:

• Accounts
• Contacts
• Documents
• Certifications
• Access requests
• Knowledge base entries
• Users
• Custom tabs
• NDA templates
• Analytics
• Built-in integrations

Built-In Integration APIs

The integration endpoints in the reference are for the integrations that are implemented in the product:

• Google Docs / Google Drive
• Notion
• Confluence
• Slack
• DocuSign

These endpoints support the Admin Center UI and shipped product flows.

Example

Use standard HTTP clients such as curl or fetch.

curl -X GET "https://app.orbiqhq.com/api/v1/documents" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

const response = await fetch("https://app.orbiqhq.com/api/v1/documents", {
  headers: {
    Authorization: `Bearer ${process.env.ACCESS_TOKEN}`,
  },
});

if (!response.ok) {
  throw new Error(await response.text());
}

const payload = await response.json();
console.log(payload);

Important Notes

• Slack and DocuSign endpoints are for the shipped integrations, not for arbitrary third-party webhook setups

Related Docs

• Integrations & API Keys
• API reference