API keys and the public API

The Workify360 Focus public API lets your own scripts and tools read reports and time data and make changes, such as adding time entries or members, with the same rules as the dashboard. The public API, API keys and webhooks are part of the Premium plan.

An API key is personal: it belongs to the person who created it and acts as that person. It can never do more than its owner’s current role allows, and it stops working when its owner leaves the organization.

Who can create API keys

The company setting for API keys decides who can create them: only owners and admins (the default), or everyone. When only owners and admins may, other people are refused (api_keys_admins_only).

• Everyone who may create keys finds their own keys on their profile’s Integrations tab.
• Owners and admins also see every key of the organization in Settings → Developers, with its owner, scopes and last use, and can revoke any of them.

Create a key

1. Choose Create API key.
2. Give it a name that says what it is for, choose its scopes and how many days it is valid: 1 to 365 days, 90 by default (api_key_expiry_invalid).
3. Confirm your sign-in if Focus asks for it; it does when your last sign-in was more than 10 minutes ago.
4. The key is shown once, with the message “Copy the key now. You will not see it again.” Copy it and keep it somewhere safe, such as a password manager.

Focus stores only a fingerprint of the key, never the key itself, so nobody at your organization or at Workify360 can show it to you again. A lost key is revoked and replaced. Each person can have up to 10 active keys (api_key_limit_reached).

Scopes and your role

A key’s scopes say which parts of the API it may use:

Scope	What it allows
me	Your own profile and your timer
reports:read	Reading reports, time entries, absences, shifts, teams, projects, tasks and exports
time:write	Adding and changing time entries, absences, shifts, tasks and time assigned to tasks, and deciding requests
org:admin	Managing members, teams, invitations and projects
webhooks:manage	Managing webhook endpoints (webhooks)

A scope does not give rights of its own. Every request is checked against your role as it is at that moment, your teams and your organization’s plan, exactly as if you did the same in the dashboard:

• You can choose only scopes your current role can use; for example an employee cannot choose org:admin or webhooks:manage (scope_exceeds_role). A scope that does not exist, or that keys cannot have, is refused (scope_unknown).
• When your role changes to one with fewer rights, your keys shrink with it: requests your new role does not allow are refused with forbidden, and the key list shows that the key’s effective scopes are smaller than the ones it was created with. When your role goes back up, the key again allows the scopes it was created with, never more.
• When your membership is suspended or ends, including through SCIM, all your keys are revoked at once. Being reactivated does not bring them back.
• If your organization moves to a plan without the API, the keys stop working until it is back on Premium (feature_not_in_plan).

Keys cannot create other keys, connect integrations or manage SCIM; those stay in the dashboard.

Call the API

Send the key in the Authorization header:

curl https://api.focus.workify360.com/v1/me \
  -H "Authorization: Bearer w360_pat_…"

The operations of the public API, with their scopes and data formats, are listed in the API reference and described in the OpenAPI document at https://api.focus.workify360.com/v1/openapi/public.json. These operations are kept backward compatible. A request with a missing, wrong, expired or revoked key gets 401.

Changes made with a key appear in the audit log under the key owner’s name, marked as made with the key, and creating and revoking keys is recorded there too (audit log).

Rate limits

Limit	Requests per minute
Per key	600
Per organization, all keys together	1,800

A request that changes something (anything other than GET and HEAD) counts as two units, any other request as one. A key can also send at most 60 units at once, which refill at 10 per second: a script that sends more than 60 reads (or 30 changes) in a burst gets 429 even though it stays under 600 a minute. Spread the requests out instead.

Every counted answer carries a RateLimit header with the units the key has left and a RateLimit-Policy header with the limits. Above a limit the API answers 429 with the code rate_limited and a Retry-After header with the seconds to wait.

Revoke a key

Revoke a key on your profile’s Integrations tab, or, as an owner or admin, in Settings → Developers. It stops working with the next request. Expired keys stop working on their own; the list warns you a week before a key expires.

Error messages

Code	What to do
api_keys_admins_only	Only owners and admins can create API keys in your organization
scope_exceeds_role	Your current role cannot use this scope; choose fewer scopes
scope_unknown	Choose scopes from the list
api_key_expiry_invalid	Choose a validity between 1 and 365 days
api_key_limit_reached	You have 10 active keys; revoke one you no longer use
api_key_not_found	The key was revoked or belongs to someone else; reload the list
rate_limited	Wait the seconds in Retry-After, then send fewer requests
feature_not_in_plan	The public API is part of the Premium plan