A REST API over your organization's verified attendance and briefing data. Every response is JSON, and every request is scoped to the organization that owns the API key.
Base URL: https://backend-production-2fc3a.up.railway.app
Send an API key as the X-API-Key header. Generate one in Settings then Integrations then Zapier. Keys are stored only as a SHA-256 hash; the plaintext is shown once and cannot be recovered.
POST /api/zapier/actions/create-briefing publishes a safety briefing. Accepts title and content (required), plus optional is_mandatory, due_date (YYYY-MM-DD) and type. A mandatory briefing emails supervisors covering the targeted sites.
400 bad request, 401 unauthorized, 404 not found, 500 server error. Errors return a JSON object with an error string. Support: support@arkvos.com
In Arkvos, go to Settings, then Integrations, then the Zapier card, and click Create key. Only owners and admins can issue keys. The key is shown once at creation and stored only as a SHA-256 hash, so it cannot be recovered afterwards -- if it is lost, revoke it and create another.
Send the key as an X-API-Key header on every request. An Authorization: Bearer header is also accepted. Do not put the key in a query string: query strings are written to server and proxy logs in plaintext.
No. Every key is scoped to the organization that created it, and every endpoint filters by that organization. There is no cross-organization path even if a key is leaked.
It stops working immediately, and any automation using it fails on its next request. Revocation is recorded rather than deleted, so a compromised key remains visible in the audit trail.
Polling endpoints return the 100 most recent records, newest first, and each item carries a stable unique id so repeated polls can be deduplicated. Zapier polls every 1 to 15 minutes depending on plan; that cadence is a reasonable guide for any integration.
No. Check-in selfies and the record's cryptographic hash are deliberately excluded from API responses. A selfie is personal biometric data that should not be syndicated to third-party applications, and the hash is only meaningful inside a signed audit export from the Arkvos dashboard.