API & integrations

Fieldcurve is API-first internally: every screen — worksheet, dashboards, imports — talks to the same fully typed, validated, permission-checked API. The public REST surface is a thin transport over those same procedures, which is why it enforces exactly the permissions the app does.

Authentication

An organization admin creates an API key under Settings → API keys. The key is shown once and stored only as a hash — we cannot show it to you again, and neither can support. Send it as a bearer token:

curl -H "Authorization: Bearer stru_sk_…" \
     https://app.example.com/api/v1/me

A key acts as the person who created it, narrowed to the permissions ticked when it was made. It can never do more than that person can, it stops working if they leave the organization, and it expires on the date you chose. Rotate by creating the replacement, switching your flow over, then revoking the old one.

Endpoints (v1)

• GET /api/v1/me — which organization and member this key acts as, and what it may do. Start here when wiring anything up.
• GET /api/v1/projects — the projects this key can see, with their rollup percent.
• GET /api/v1/projects/{id}/export.xlsx — the project as the standard Fieldcurve workbook: byte-for-byte what the Export button produces.
• POST /api/v1/projects/{id}/import — send a workbook as the raw request body. Add ?dryRun=true to get the classification (creates, updates, conflicts, errors) without writing anything. A real import is one transaction: it applies completely or not at all, and refuses outright if the file conflicts with the project’s current state.

Errors are JSON — {"error":{"code","message"}} — with the HTTP status you would expect: 401 for a bad key, 403 for a permission the key does not carry, 409 when a file conflicts, 429 when you exceed 120 requests a minute.

SharePoint, Teams and Power Automate

We deliberately do not ask for access to your document libraries. Power Automate already has first-class SharePoint, Teams and scheduling connectors, and your IT department already governs it — so the round trip runs on your credentials, inside your tenant:

1. Nightly export. Recurrence → HTTP GET the export endpoint → Create file in a SharePoint library.
2. Watched-folder import. When a file is created in a library → HTTP POST it to the import endpoint with ?dryRun=true → post the summary to a Teams channel → POST again without the flag once someone approves.

Store the key in your flow’s secure inputs or a Key Vault connection, never in plain text in the flow definition.

What is not here yet

No webhooks — integrations poll today. No pagination or filtering on collections, and no write endpoints beyond the Excel import. Those are additive when they land; nothing described above changes shape without a new version. If an integration would decide your evaluation — historian hooks, Power BI, a completions system — tell us which one. Real demand sequences the roadmap.