Browse the DEAP API

API reference

Preview

DEAP API

Run the same commands the DEAP app runs across finance, operations, workforce and the records around them.

Version
1.0.0
Endpoints
1,195
Areas
156
Open API Explorer

Base address

Requests go to your own workspace address, the one you sign in at.

Authentication

Send the access token of a signed-in user as a Bearer token. The token carries the tenant, the user and their roles, so no tenant header is needed.

How the API behaves

One command per call
Every operation is a POST to its own path. The JSON body is the command itself; it is not wrapped in another object.
The tenant comes from the token
The access token decides which tenant a command acts on. A tenant, user or role sent in a header is discarded.
Choosing a company
Send X-Company-ID to act on a company other than the session's own. The call is refused with 403 if the caller has no access to it.
Retries
Send Idempotency-Key with a value unique to the attempt, so a retry is not applied twice.
Execution authority
Some actions need a separate grant. Without it the call answers 403 with EXECUTION_AUTHORITY_REQUIRED and says whether to ask for the grant or to re-authenticate.
Request fields
The fields each command takes are not published per operation yet. Refusals answer 422 with a message that names what was wrong.

Headers on every request

Each endpoint page lists these again, with any header that is its own.

  • AuthorizationstringRequired

    Access token of a signed-in user. It carries the tenant, the user and their roles.

  • Idempotency-KeystringOptional

    A key you choose that is unique to this attempt, so a retry is not applied twice.

  • X-Company-IDstringOptional

    Company the command acts on. Refused with 403 if the caller has no access to it.

  • Content-TypestringRequired

    Always application/json.

Errors every endpoint can return

Every error carries an HTTP status. Where it also carries a code, branch on the code, not on the message.

  • 400The body is not one JSON value.
  • 401The access token is missing, expired or not valid.
  • 422The command was refused: a field is invalid, or the record is not in a state that allows the action. The message says which.

All endpoints

Bangladesh

Cross domain

Finance

Identity

Operations

Organization

Platform

Sales

System

Workforce