Build on the Integration API

Quick start

Make your first Integration API call in a few minutes.

1. Create an integration token

In the product, open Integrations and create a token. Grant only the scopes you need (for example programs:read and submissions:read). Copy the token once — it is not shown again.

2. Call a read endpoint

curl -sS https://api.newempactwork.com/integrations/v1/programs \
  -H "Authorization: Bearer YOUR_TOKEN"

3. Optional: protect writes with an idempotency key

On POST, PATCH, and DELETE you can send an Idempotency-Key header. If the same token sends the same key and the same body again within 24 hours, the API returns the original response instead of applying the change a second time. Useful when a client retries after a timeout or network error.

curl -sS -X POST https://api.newempactwork.com/integrations/v1/submissions \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: crm-sync-2026-03-20-001" \
  -d '{ ... }'

Authentication

The Integration API uses scoped bearer tokens. Tokens are auditable per request.

Bearer token

Authorization: Bearer <64-char hex token>

Create and revoke tokens under Integrations in the product. Revoking a token takes effect immediately.

Scopes

Each route requires a matching scope. A read-only token cannot write.

• Read: submissions:read, programs:read, tracks:read, rounds:read, reviews:read, feedback:read, supplements:read, audit:read, payments:read, assignments:read, reviewers:read, emails:read, applicants:read, files:read, schemas:read, rubrics:read, exports:read
• Write: submissions:write, assignments:write, supplements:write, feedback:write, programs:write, tracks:write, rounds:write, reviewers:write, emails:write, exports:write

Program and track PATCH via the Integration API allow name/dates/lifecycle (program), intake fields (track), and branding copy only (header/footer/page text) — not colors, logos, NDA, or settings.

Rate limits

300 requests per minute per token on /integrations/v1. Creating an export (POST /exports) is additionally limited to one request per five minutes per token.

Program export

Async JSON package for a programme — for CRM sync and AI tools.

1. POST /integrations/v1/exports with exports:write and a required programId (optional trackId, state, date filters). Returns exportId with status pending.
2. Poll GET /integrations/v1/exports/:exportId with exports:read until completed or failed.
3. When completed, use downloadUrl (expires in about one hour) to fetch the JSON file.

The file includes applicants (name/email), reviewers (name/email), submissions, raw reviews (scores and comments), and completed COI attestations (program-scoped even when trackId is set). It contains personal data — grant export scopes only when needed. Existing tokens do not receive new scopes until you update them.

Idempotency

Optional Idempotency-Key on POST, PATCH, and DELETE. Cached for 24 hours per business + token + key + request body hash.

Webhooks

Register HTTPS endpoints in the product. We POST signed JSON when domain events occur.

Payload shape

{
  "eventType": "submission.submitted",
  "eventId": "…",
  "timestamp": "2026-03-20T12:00:00.000Z",
  "data": { }
}

Signature verification

Every delivery includes X-Webhook-Signature: sha256=<hex>, an HMAC-SHA256 of the raw request body using your endpoint secret. Verify with a constant-time compare before trusting the payload.

# Pseudocode
expected = hmac_sha256(secret, raw_body).hex()
assert timing_safe_equal(header_value, "sha256=" + expected)

Retries

Failed deliveries (non-2xx or network errors) are retried by the delivery worker. Make handlers idempotent using eventId.

Event catalog

Types and data schemas live in the webhook events reference.