API reference

The Workshop1 Integration API is the server-to-server REST boundary for approved external systems. Studio and Mobile use a separate first-party transport, so browser network calls are not an integration contract.

Current access

Workshop owners can open Settings → API keys and select Create API key. Studio shows the secret only once and lets the owner copy the API key or complete Authorization header value.

Studio does not currently provide the permission controls required to grant a new key access to Integration API resources. A key created there has no resource grants, so Integration API requests made with it are refused. Contact Workshop1 before starting a production integration.

When access is provisioned, treat the key like a password. Keep it on a server, do not embed it in browser or mobile code, and revoke it when the integration is retired or exposed.

API key permissions are scoped by resource and operation. A request is refused when the key does not grant the required operation, even if the route exists.

Supported resources

The implemented Integration API surface covers Customers, Fleets, vehicles, Products, prices, stock, Suppliers, Supplier Orders, tags, Work Orders, Quotes, Invoices and Payments.

Bookings, inspection records and Documents are managed through Workshop1's first-party product and are not part of this REST surface.

Contract availability

The Integration API contract is an OpenAPI 3.1 document served at /api/v1/openapi.json on the Workshop1 API host. It can be read without an API key and is the source of truth for request fields, responses and supported operations. Do not infer an API operation from a control visible in Studio.

Once Integration API access is enabled for your Workshop, Workshop1 supplies the API base URL to use with that contract.

All requests are scoped to the Workshop that owns the key. Integrations should handle standard HTTP error responses:

• 400 when the request body, path or query fails schema validation;
• 401 when the bearer key is missing or invalid;
• 402 when the Workshop does not have an active subscription;
• 403 when the key lacks permission for the operation;
• 404 when the resource is absent or not visible to that Workshop;
• 409 when the request conflicts with current record state;
• 422 when parsed input is not valid for the requested domain operation.

Use a separate key per external system so access can be reviewed and revoked independently.