Skip to content

WorkWing API

The API is the product.

The WorkWing console and mobile app run on the same platform you build on: the same records, the same organisation and brand boundaries, and the same row-level permissions an API key is held to. There is no separate integration database and no export to wait for.

Create and manage customers, jobs, projects, resources and schedules from your own systems, and have WorkWing tell you when something changes with webhooks. The API is on every plan, Free included.

Base URLhttps://api.workwing.io/v1
StyleREST over HTTPS, JSON bodies, OpenAPI 3.0.3
AuthBearer API key, scoped per permission
WritesIdempotency-Key header on every write
Rate limitPer key, per minute: 60 on Free to 2,000 on Professional
Events24 signed webhook events

Quick start

Create a key under Settings > API Keys, tick the permissions the integration needs, and copy it: it is shown once. Your organisation and brand come from the key, so the base URL is the same for everyone.

Request
curl https://api.workwing.io/v1/jobs \
-G -d limit=1 -d select=id,job_number,status \
-H "Authorization: Bearer ww_sk_live_abc123.xxxxxxxx"
Response
{
"data": [
{
"id": "0198f0c4-5a11-7c62-9d84-000000000003",
"job_number": "JOB-00042",
"status": "T_SCHEDULED"
}
],
"meta": {
"request_id": "0198f0c4-9b12-7d5a-8e41-6c2b7a9f0d33",
"timestamp": "2026-09-09T10:15:00.000Z"
}
}

Every successful response puts the result under data. The getting started guide covers permissions, writes, errors and paging in full.

Core concepts

What holds across every endpoint, and where each is documented in full.

Authentication

Send the key as a bearer token. A key belongs to one brand and carries action:resource permissions such as read:jobs or create:customers. A call the key is not permitted answers 403 E_AP_1102.

Authorization: Bearer ww_sk_live_<tokenId>.<secret>

API keys

Idempotency

Every POST, PATCH, PUT and DELETE carries an Idempotency-Key you generate. Retry with the same key and body within 24 hours and you get the original response, marked Idempotency-Replayed: true, rather than a second job.

Idempotency-Key: 7d6f1c2a-4b3e-4d5f-9a10-2c8e5b1f3a44

Create jobs safely

Errors

Every failure has one envelope: a stable code to branch on, a message for your log and a request_id to quote to us. Codes are grouped by cause, so E_AP_10xx is authentication and E_AP_80xx is rate limiting.

{ "error": { "code": "E_AP_6011", ... }, "meta": { "request_id": "..." } }

Handling errors

Rate limits

The limit is per key, per minute, set by your plan: 60, 120, 600 or 2,000. Every response carries your position; going over returns 429 E_AP_8001 with Retry-After.

X-RateLimit-Limit X-RateLimit-Remaining X-RateLimit-Reset

Rate limits

Querying

Lists filter, sort, select and page in the query string. select embeds related records in the same call. A page holds at most 1,000 rows; Prefer: count=exact puts the total in Content-Range.

?status=eq.T_SCHEDULED&order=created_at.desc&limit=25

Filtering and paging

Webhooks

WorkWing posts to your endpoint when a job, assignment, customer or resource changes. Each request is signed with HMAC-SHA256, retried when your endpoint fails, and carries a key so you can spot a repeat.

X-Webhook-Signature X-Webhook-Event X-Webhook-Idempotency-Key

Webhooks

OpenAPI

The reference below is rendered from one OpenAPI document. Each operation lists the permissions it needs as x-required-scopes. Generate a client from it, or give it to the AI assistant writing your integration.

https://docs.workwing.io/openapi.json

openapi.json

Core resources

The records most integrations start with. Each has its own section in the reference, with notes, attachments and custom fields where the record has them.

ResourceCollectionWhat it is
Jobs/v1/jobsA unit of work at a customer's site, built from a job type, with a status, a window, notes, parts and attachments.
Projects/v1/projectsA job that owns a pool of jobs sharing a window and a crew.
Assignments/v1/jobs/{jobId}/assignmentsA resource put on a job, with its own status from en route to completed.
Customers/v1/customersThe organisations and people you do work for.
Locations/v1/locationsA customer's sites, with an address and coordinates.
Resources/v1/resourcesYour engineers and other field staff, with skills, working hours, absences and last known position.
Job types/v1/job_templatesThe kinds of work you do and the form each one carries. Read-only over the API.
Job schedules/v1/job-schedulesRecurring work that creates jobs on a pattern, which you can pause, resume or cancel.
Custom fields/v1/custom-field-definitionsYour own fields on jobs, customers and resources. Define them, then set values per record.
Brands/v1/brandsEach brand's configuration and terminology. Read-only over the API.

Typical workflows

What integrations commonly do, with the calls involved. Most link to a recipe worked end to end.

API reference

Every endpoint, with its request body, response shape, required permissions and a console to call it from. Rendered from openapi.json.