WaymarqWaymarq
Sign up

Reporting and admin

Integrations, webhooks and the API

Getting data out of Waymarq and into whatever else you use.

Everything here is optional. Find it under Integrations in the sidebar (owners and admins).

Webhooks

Waymarq can call a URL of yours when something happens. Subscribe an endpoint to the events you care about:

  • quote.accepted
  • support_ticket.received
  • project.status_changed
  • task.completed
  • opportunity.stage_changed
  • payment.received

Deliveries are always queued, so a slow or dead endpoint of yours can never stall the action that triggered it. Every payload is signed (HMAC-SHA256) so you can verify it came from us and reject replays. Failed deliveries retry with backoff; after ten consecutive failures the endpoint switches itself off and stays visible with its failures shown, rather than hammering a dead URL forever.

There's a Send test button that goes through the identical delivery path a real event uses — a test that took a shortcut wouldn't prove your signature check, headers or URL actually work — and test deliveries don't count against endpoint health.

Every exchange is logged with the request, the response and how long it took, kept for 30 days.

Full reference, including verification code in PHP, Node and Python: /webhook-docs.

Zapier, Make and n8n

If you'd rather not write anything, these three connect Waymarq to a few thousand other tools between them, and both directions already work.

Out of Waymarq: start a scenario with a webhook trigger, copy the URL it gives you, and add it here as an endpoint. Send a test delivery straight away — all three of them learn the shape of a payload from one they've actually received, so until they have one there's nothing to map fields against. Test deliveries carry a test flag, so branch on it if the scenario does anything a client would notice.

Into Waymarq: that's the API rather than webhooks. Use an HTTP request step with an API token, and an automation can create projects, tasks, clients or time entries from a form, an inbox, or a tracker you haven't finished moving off yet.

There's no listed Waymarq app in their directories yet, so you paste a URL rather than picking us from a menu. Everything else about it is the same.

The REST API

A token-authenticated API covering projects, phases, tasks, subtasks, files, task attachments, comments, time, clients, opportunities, quotes, work orders, statements, the support desk and reports.

Create a token under Organisation settings → API → New token. It asks three things in turn:

  • Who it acts as. A token of your own acts as you and is deleted along with your account — right for your own scripts. An organisation token acts as the organisation itself and keeps working when someone leaves, which is what you want for anything the team relies on: a CI job, an accounting sync, a shared AI connection. Owners and admins can create those.
  • What it's allowed to do. Pick the narrowest thing that does the job. This is fixed once the token exists — to change it, make a new one and revoke the old.
  • What it's called. Only you see this, so name it after whatever holds it.

The token is shown once — we store only a hash, so a lost one can't be recovered.

Telling your keys apart, and replacing one

The list shows the first few characters of each key alongside its name, so you can match a row against what's actually in your .env or CI variable. That's all we keep in the clear; the rest is a hash, and it stays that way. Making a key revealable later would mean storing it in a form that could be read back, which turns every database backup into a set of live credentials — so we don't, and the first few characters get you the same answer without the risk. Keys created before this was added show no prefix, because there was never anything to show.

Rotate replaces a key without a gap. You get the new one immediately, and the old one keeps working for 24 hours so you have time to update wherever it's configured and redeploy — then it stops on its own. The replacement carries the same name, the same permissions and the same organisation, so nothing quietly widens during a routine swap.

If a key has leaked, don't rotate — revoke it. That stops it immediately, with no grace period.

Two things worth knowing before you build against it:

  • Status changes go through their own endpoints rather than a general update, so the audit trail can't be bypassed.
  • GET /projects/{project}/unbilled answers "what should be invoiced" in one call. Together with issuing a statement, that's the seam an accounting integration plugs into.

Interactive reference at /api/documentation; the plain-text version at /api-docs.

Bring your own AI

You can point a coding assistant such as Claude at the API and have it set up and maintain whole projects from a specification. Organisation settings → API → Import guide generates a ready-made prompt with your details filled in.

This works whether or not Waymarq's own AI is switched on — your agent does the thinking, Waymarq stores the result.

Planned

Accounting (Xero and QuickBooks), Stripe payment links, Microsoft Teams and cloud storage are on the roadmap. The Integrations page marks everything as either available now or planned, so you can see what's real without guessing.