Developers

Build with the Webb9 API.

The Webb9 v1 API lets approved apps read and write customer data, jobs, quotes, and invoices with a scoped API key — without bypassing tenant isolation or consent. Apply for sandbox access to get a key today.

Live now

Seven resources, one credential, tenant-scoped by design.

Every resource supports GET (list + detail) and POST/PATCH writes, with cursor pagination and idempotent creates.

Request sandbox access

Customers

/v1/customers

Read and write customer records.

Leads

/v1/leads

Create and read leads; source is attributed to your app/key.

Jobs

/v1/jobs

Create jobs (work orders), update fields, and move status.

Quotes

/v1/quotes

Create quotes and accept them on the customer’s behalf.

Invoices

/v1/invoices

Create/update invoices and record external payments for reconciliation.

Files

/v1/files

Create an upload intent, then attach the file to a customer or job.

Webhooks

/v1/webhook-endpoints

Subscribe to lead/job/quote/invoice/payment/document events, with signed, retried, replayable delivery.

Authentication

Two ways in, both fully live.

  • Scoped server API keys (wb9_sk_live_… / wb9_sk_test_…), created and revoked from your account, never displayed again after creation.
  • OAuth 2.0 Authorization Code + PKCE for apps installed by other Webb9 businesses — rotating refresh tokens, reuse detection revokes the whole token family.
  • A developer console in the Webb9 dashboard: create/rotate/revoke API keys, manage webhook endpoints and delivery health, and review/revoke installed OAuth apps — no need to script against the API for credential management itself.
  • Every credential is tenant-scoped to one business — no request can read or write another business’s data, by construction.
  • Granular scopes such as customers.read, jobs.write, invoices.read, payments.write, and files.write — a key only carries the scopes you grant it.
  • An Idempotency-Key header is required on every resource-creating POST (customers, leads, jobs, quotes, invoices, files, webhook endpoints) and on the quote-accept/file-attach/replay actions — retrying with the same key replays the original response instead of repeating the action. Plain field-edit PATCH requests don’t require one.
  • Cursor-based pagination and status/date filtering on every list endpoint.
  • Webhook deliveries are signed (HMAC over a timestamp + body, so a captured request can’t be replayed later), re-validated against SSRF at send time, retried with backoff, and auto-disabled after sustained failure.
Full reference

Auth, scopes, endpoints, errors, and webhooks.

The complete reference — generated straight from the live OpenAPI spec, so it never drifts out of sync with what's deployed.

Read the API reference
Example flow

Quote to invoice, pushed to you as it happens.

1POST /v1/webhook-endpoints subscribes to quote.accepted and invoice.paid
2POST /v1/quotes creates a quote for a customer
3POST /v1/quotes/:id/accept records their decision
4Your endpoint receives a signed quote.accepted event — no polling
5POST /v1/invoices creates the matching invoice
6POST /v1/invoices/:id/payments records external payment
7Your endpoint receives a signed invoice.paid event