Last updated 12 Oct 2026
Module
Public API and webhooks
A public API and webhooks for your own connections
The public API and webhooks let your developers connect Autonomy Care to other systems, such as BI tools, plan managers or Zapier. It is a REST API documented in OpenAPI, with scoped API keys, rate limits and idempotent writes, plus signed webhooks for events like a shift being created or an invoice being paid. It is an add-on.
What can the API read and write?
Scopes cover reading participants (limited fields, with no date of birth, health details or address), staff, shifts, timesheets, invoices and incidents (without the narrative), creating shifts, and managing webhooks.
How are webhooks secured?
Each webhook has its own secret. Requests are signed with HMAC-SHA256 and a timestamp, so you can check they came from us and reject replays. Webhooks carry ids only, so you fetch details with your key.
Is the API included?
The public API is an add-on and isn't one of the standard modules. Ask our team to add it to your licence.
What it does and doesn't do
It does
- Provides a documented REST API with scoped keys
- Sends signed webhooks with retries and a delivery log
- Limits participant data to the fields a scope allows
It doesn't
- Isn't included in the default bundle
- Doesn't expose clinical narratives such as incident descriptions
Frequently asked questions
Can we use Zapier?
Zapier can call a REST API and receive webhooks, so it can be used with your API key. Webhooks also accept the subscribe and unsubscribe calls Zapier uses. There isn't a listed Zapier app.
How are API keys stored?
Keys are shown once and stored only as a hash. They can have an expiry, can be revoked, and show when they were last used.
Are there rate limits?
Yes, 120 requests a minute per key, with rate limit headers in each response.
What if our webhook endpoint is down?
Deliveries are retried 8 times over about 24 hours. After that the webhook is turned off and your admins are told. A 30-day delivery log lets you resend.
How it works
Turn on the add-on
The public API is added to your licence on request.
Create a key
Create an API key in Settings with only the scopes it needs. The key is shown once.
Call the API
Read participants, staff, shifts, timesheets, invoices and incidents, or create shifts, with pagination and rate limits.
Subscribe to webhooks
Receive signed events such as shift created, timesheet approved or invoice paid.
Who uses it
Developers and IT teams
Data and BI teams
Partners such as plan managers
Related modules
Integrations
Integrations connect Autonomy Care to Xero, MYOB, QuickBooks Online, HubSpot and Employment Hero Payroll. Invoices and customers go to your accounting system with payment status read back, approved SCHADS hours go to payroll, and plan managers and support coordinators go to HubSpot. Connections use OAuth, with a sync log and automatic retries.
Reports
Reports show how your organisation is going across service delivery, finance, workforce and compliance. Autonomy Care has ready-made reports, such as revenue and margin, utilisation, rostering fulfilment, credential expiry and incidents, plus shift financials and an executive summary. Reports export as CSV or PDF and can be emailed daily, weekly or monthly.
See it with your own rosters and plans
Get started, or book a demo and we will walk you through it with your questions.