A REST API for CRUD and a GraphQL endpoint for reads that would otherwise take four round trips. OAuth 2.0 throughout. Everything the first-party integrations do, you can do.
Workspace settings, Developers, New app. You get a client ID and secret, scoped to the workspace you created it in.
Standard OAuth 2.0 authorisation code flow with PKCE. Tokens live one hour, refresh tokens thirty days.
Base URL https://api.nexaflow.com/v4. Everything is JSON, everything is UTC, and every list endpoint is cursor-paginated.
Register a webhook rather than polling. Polling a list endpoint on a schedule is the fastest way to meet the rate limiter.
https://api.nexaflow.com/v4limit up to 100, next in the envelope/v4/graphql, read-only, depth limit 8No. Every first-party integration is built on the same public endpoints you have. If an integration can do it, so can you.
A 429 with a Retry-After header. Sustained overage on Enterprise raises a conversation, not a cut-off.
Twelve months of overlap from the day the replacement ships. We have never removed an endpoint without a replacement being live first.
No. Every plan including Starter gets a sandbox workspace with the full API surface.