The Worksuite API lets your own systems read and update your Worksuite data, so your HR, finance and project tools stay in step without anyone retyping records. This article explains how API access is set up, which user the API acts as, what data and webhooks are available, how accounting tools connect, and how single sign-on (SSO) creates accounts.
Who this is for: Admins and the developers who build your integrations.
Availability: API access and the standard webhooks below are available on request. Worksuite Support issues the credentials. For webhooks or automations beyond the standard list, talk to your Business Solutions Architect.
TABLE OF CONTENTS
- How you get API credentials
- The API acts as one Worksuite user
- If API calls fail with "Logged user has to be Buyer"
- What the API covers
- Webhooks
- Invoice and accounting data
- SSO sign-in and new accounts
- Related articles
- Support/Resources
How you get API credentials
API credentials can't be generated inside Worksuite. Contact Worksuite Support and tell us:
- which Worksuite user the API should act as (see the next section), and
- the email address of each person who should receive the credentials.
We send the client ID and secret securely to the people you name. For an extra set of credentials, or to replace a set you think was exposed, contact Support the same way.
The API documentation covers authentication, every endpoint and example requests:
The API acts as one Worksuite user
Each set of credentials belongs to one user in your account. Every API call runs as that user:
- The API can see and change exactly what that user can in Worksuite. If the API can't see something, check that user's role first.
- Records created through the API show that user as the creator, and activity logs list them as the person who acted.
We recommend a dedicated service account, such as integrations@yourcompany.com, with a role that has only the access your integration needs. Then API actions aren't mixed up with a real person's work, and the integration keeps running when people leave.
If API calls fail with "Logged user has to be Buyer"
This error means the user who owns the API credentials was removed or archived. Every call made with their credentials fails until this is fixed.
Contact Worksuite Support. We can move the API credentials to an active service account so your calls work again. Before you remove a teammate, check with your developers whether that person owns any API credentials.
What the API covers
The API can read and write the main records in your account, including freelancer profiles, Contracts, projects and tasks, timesheets, invoices and payments. The API reference lists every endpoint and field.
If you send too many requests in a short time, the API returns a 429 error. Wait a moment and send the request again.
Webhooks
Webhooks tell your system when something changes, so you don't have to keep asking the API. You register a webhook through the API with the event and the address that should receive it. These standard events are available:
| Event | Sent when |
|---|---|
| payment_created | An invoice is created |
| payment_status_updated | An invoice changes status, for example to Approved or Paid |
| task_created | A task is created |
| task_updated | A task's details change |
| task_status_updated | A task changes status |
| applicant_status_changed | A job opening applicant moves to a new status |
| partner_created | A freelancer profile is created |
| partner_updated | A freelancer profile changes |
| partner_status_updated | A freelancer's status changes |
| partner_availability_updated | A freelancer updates their availability |
When you register a webhook, you can set a secret. Worksuite then signs each delivery with an X-Worksuite-Signature header, so your system can confirm the message came from us. Each event has its own ID, so you can ignore repeats.
A changes feed is also available on request. It lists freelancer profile and bank detail changes, so you can catch up on anything you missed. For events that aren't in this list, ask your Business Solutions Architect.
Invoice and accounting data
Through the API you can get each invoice's totals, line items, the tax on each line item, its status and dates, custom fields and external IDs.
Freelancer bank details are also available through the API once Worksuite turns them on for your account. The API user's role needs Can access Partners Payout Methods. For tax forms or tax ID numbers, check the API reference or ask Worksuite Support.
Teams connect their accounting tools in one of three ways:
- Integration set up by Worksuite. Worksuite has integrations for QuickBooks Online and NetSuite that sync freelancers and invoices. Our team configures them. Once one is running, its sync status shows under Settings → Integrations.
- Zapier. Build your own automations with the Worksuite app in Zapier. See Connect Worksuite to Other Apps with Zapier.
- Your own build using the API and webhooks above.
Talk to your Business Solutions Architect about which option fits your account.
SSO sign-in and new accounts
SSO is turned on by contacting Worksuite Support. With SSO, your identity provider (for example Okta, Microsoft Entra ID or Google) decides who can sign in. How Worksuite treats people it hasn't seen before depends on how SSO is set up for your account:
- Open sign-in (the default): anyone your identity provider lets into the Worksuite app gets a teammate account the first time they sign in, with no invitation. If your identity provider lets in everyone on your company's email domain, a freelancer with a company email address can end up with a teammate account.
- Invite-only sign-in: only people you've invited to Worksuite can sign in with SSO. Anyone else is refused. Invite new teammates before they try to sign in.
Worksuite Support can tell you which setup you have and switch it for you. By default, people Worksuite creates through SSO sign-in may get the Admin role, so ask us which role new SSO sign-ins receive in your account.
To give access to someone whose email is on another domain, such as a consultant, invite them in Worksuite and assign them to the Worksuite app in your identity provider. Worksuite doesn't need to approve their email domain.
Related articles
- Connect Worksuite to Other Apps with Zapier: build automations with Zapier
- Single Sign-on (SSO) Authentication: set up SSO with your identity provider
- How to Invite and Remove Team Members: invite and remove teammates
Support/Resources
Still have questions about the Worksuite API and integrations? Click Support in the bottom-left corner of Worksuite to contact our Support team, or email support@worksuite.com. Including a link to the page you're on and a screenshot helps us answer faster.