The HibritİK REST API
The same API the web and mobile apps use: API key authentication, access limited by role permissions and the same endpoints in on-premises installations.
How it works
REST and JSON
Every endpoint lives under /api/ and works with JSON HTTP requests. The web and mobile apps use the same API; there is no separate “integration API”.
API key authentication
The organisation’s administrator generates a key (hbk_…) by choosing a role for the integration. The key is sent in the X-Api-Key header and works only with that role’s permissions; only its SHA-256 hash is stored on the server.
Permission-based access
Every endpoint is protected by a permission (e.g. list tasks, create task). Permissions missing from the key’s role are rejected with 403, and organisation data is limited automatically by the tenant filter.
On-behalf-of and multi-company use
A key whose role has the integration.act_as permission can act on behalf of an employee via the X-On-Behalf-Of header (membership Id or e-mail); every such action is written to the audit log. For a key copied to several companies, the company is selected with X-Tenant-Id.
The same API in the cloud and on-premises
The cloud address is api.hibritik.com; in an on-premises installation the same API runs on the organisation’s own domain. The OpenAPI 3 document is shared at the contract stage.
Integration projects
We do not offer off-the-shelf connectors. We set up data exchange with your existing HR, accounting or similar systems together, as a project planned around your needs over the REST API.
Sample request
The same API the web and mobile apps use: API key authentication, access limited by role permissions and the same endpoints in on-premises installations.
curl https://api.hibritik.com/api/tasks?mine=true \
-H "X-Api-Key: hbk_xxxxxxxx_................................" \
-H "Accept: application/json"curl -X POST https://api.hibritik.com/api/tasks \
-H "X-Api-Key: hbk_xxxxxxxx_................................" \
-H "X-On-Behalf-Of: [email protected]" \
-H "Content-Type: application/json" \
-d '{ "title": "Aylık rapor", "description": "Ekim raporu hazırlanacak" }'Integration in four steps
- 1Define an integration roleIn the administration panel, create a role with only the permissions needed, for example just reading and creating tasks.
- 2Generate an API keyOn the API keys screen, choose the role and generate the key. The key is shown only once; store it in a secure secret store.
- 3Send your requestsAdd the X-Api-Key header to every request. Errors come back as RFC 9457 ProblemDetails in the user’s language.
- 4Revoke when neededA key can be revoked instantly from the screen, and every on-behalf-of action is visible in the audit log.
Endpoint areas
The API covers every module of the product; these are the most commonly used areas. The full list is in the OpenAPI document.
/api/tasksTasks, subtasks, board and Gantt/api/projectsProjects and sprints/api/project-requestsProject requests and approval/api/leaveLeave requests/api/overtimeOvertime/api/performancePerformance periods/api/qualityQuality and CAPA/api/vehicle-requestsVehicle requests and fleet/api/communicationAnnouncements, documents and surveys/api/usersUsers and memberships/api/departmentsDepartments/api/api-keysAPI keys
Frequently asked questions
Is the API documentation public?
The OpenAPI 3 document is not published publicly on the cloud address; it is shared when an integration is planned or at the contract stage. You can request it through the contact form.
Does an API key reach all of the organisation’s data?
No. The key works only with the permissions of the role it is given; endpoints outside the role are rejected. Acting on behalf of someone additionally requires the integration.act_as permission.
Is the API different in an on-premises installation?
No. The on-premises edition is the same software as the cloud edition; the API runs on the organisation’s own domain with the same paths.
Planning an integration or a custom module?
Let us scope on-premises installation, data exchange with your existing systems and custom module development together; we share the OpenAPI document at this stage.