Developer reference and contract boundaries

Before implementing a client

The frontend calls business-scoped dashboard APIs and exposes integration configuration. Those calls are evidence of UI behavior, not a promise that an external integration key can call every dashboard endpoint. Obtain the external backend contract before shipping a server-to-server client.

Configuration metadata used by the dashboard

The following routes are present in the frontend client. Use your environment's configured API base, including its version prefix; these paths are relative to that base. Access requires the authorization supported by the backend for the operation.

The type response consumed by the client contains metadata describing display names, descriptions, and authentication methods. Scope and event selectors are derived from their respective metadata responses. Use the business and integration that own the operation.

Create-integration shape

The frontend sends this shape for integration creation, with values selected from backend metadata:

{
  "type": "<supported integration type>",
  "authMethod": "<supported authentication method>",
  "isActive": true
}

External API release checklist

Confirm endpoint paths, authentication headers and scopes, request/response schemas, pagination fields, errors, and rate-limit behavior against the backend contract. For imports also confirm identifiers, required variant fields, upsert behavior, partial failures, and replay behavior. For signed webhooks confirm raw-byte signing, timestamps, algorithm, and replay protection.

The external product API and signature reference are checked against the local backend implementation. Other external endpoints still need their own verified contracts. There is no universal plan-based rate-limit table or public WebSocket contract established here. Do not copy dashboard session credentials into external services. The previous generic examples are replaced here to avoid presenting unverified contracts as production APIs.

Error diagnosis

Inspect the actual HTTP status and error body. Check authentication/expiry, business permissions, validation, and limits as reported by the server. Log correlation IDs when provided and remove secrets. For real-time UI failures compare the inbox after refresh; do not build an external socket consumer from internal event names alone.

Next steps

Use authentication, webhooks, and external products for the supported setup flows.