REST API
Anything you can do in the APEX app you can do from your own tools through the REST API. Endpoints take JSON and return JSON. This page describes how to authenticate, where the endpoints live, and which endpoint groups exist. It does not list every route.
NOTE
A full per-route specification (OpenAPI) is in progress and is available on request today. The endpoint groups below are stable; the published auto-generated reference is not live yet. Confirm current availability with your APEX contact before building against it.
Base path and format
| Property | Value |
|---|---|
| Base path | /api |
| Request body | JSON |
| Response body | JSON |
| Transport | HTTPS only |
Authentication
APEX authenticates requests with a signed access token. After you sign in, the token is stored in an HTTP-only cookie named apex_access, which the browser sends automatically and never exposes to page JavaScript. A separate HTTP-only cookie handles token refresh.
| Item | Detail |
|---|---|
| Access token | RS256-signed JWT, carried in the apex_access cookie |
| Refresh | Handled through a separate HTTP-only refresh cookie |
| Legacy header | An Authorization: Bearer <token> header is still accepted while the cookie migration is underway |
For requests that change data (anything other than a read), APEX uses double-submit CSRF protection. Read the value of the non-HTTP-only apex_csrf cookie and send it back in the X-CSRF-Token header on those requests.
NOTE
The bearer-header path is described in the source as a legacy fallback during a migration. Treat it as transitional and confirm it is still accepted before relying on it for a long-lived integration.
Endpoint groups: Company account
These endpoints serve your own Company account. All are mounted under /api.
| Group | Example paths | Covers |
|---|---|---|
| Projects | /api/projects, /api/projects/:id/... | Project records and their nested data |
| Field operations | /api/fieldops, /api/fieldops/:id/approve, /decline, /counter-propose | On-site visits and their workflow |
| Rooms, locations, equipment | /api/room-status, /api/room-status/locations/list, /api/room-status/:roomId/equipment | Rooms and their status, the locations and floors above them, and per-room equipment inventory |
| Partners | /api/vendors, /api/vendors/:id | Partner records. Compliance credentials are a Partner portal endpoint (see below), not a Company one. |
| Licenses | /api/licenses, /api/licenses/summary | Platform licenses and renewal status |
| Threads | /api/threads/:type/:itemId | Discussion threads on a work item |
| Administration | /api/admin-portal/administration/users, /api/admin-portal/administration/audit, /api/admin-portal/administration/settings | User management, the account audit log, and workspace settings. Role assignment happens through user management; there is no standalone role-listing endpoint. |
| Reports | /api/admin-portal/reports/portfolio-health, /financial, /team-performance, /field-operations, /compliance, /vendor-performance | Reporting data |
| Cisco | /api/cisco/config, /api/cisco/status, /api/cisco/devices, /api/cisco/workspaces | Cisco Control Hub connection and device data |
Endpoint groups: Partner portal
These endpoints serve partner users and are scoped to the partner's own organization and invited projects. They mirror the Company endpoints in shape but return only partner-visible data. The paths below are shown under /api/vendor/*, the original prefix; an /api/partner/* prefix is mounted as an equivalent alias for the same routes.
| Group | Example paths |
|---|---|
| Projects | /api/vendor/projects, /api/vendor/projects/:id |
| Equipment | /api/vendor/equipment, /api/vendor/equipment/:id, /:id/service-events, /:id/attachments |
| Location documents | /api/vendor/locations/:locationId/documents |
| Field operations | /api/vendor/fieldops, /api/vendor/fieldops/:id/mark-on-site, /complete, /reschedule, /cancel, /accept-counter |
| Credentials | /api/vendor/credentials |
| Licenses | /api/vendor/licenses |
| Threads | /api/vendor/threads/:type/:itemId |
Access boundaries
The API enforces the same boundaries as the app. Your token determines which account you reach and, for partner tokens, which organization. A request for data outside that scope returns 404, not 403, so account identifiers cannot be probed by trial and error.
For the role limits that also apply to API requests, see Roles and access. For how account data is kept separate, see Data isolation and security.