Auroranexis

The Auroranexis REST API lets your workspace integrate with external systems, automate operational workflows, and receive event notifications. Manage keys and webhook endpoints in Settings → API. For endpoint-level details, use the interactive OpenAPI reference at /api/docs.

The Auroranexis API is a RESTful, organization-scoped interface. Every request is authenticated with an API key that carries explicit scopes limiting what the key can read or write. The API follows standard HTTP conventions — JSON request and response bodies, appropriate status codes, and TLS encryption for all traffic.

API access availability and rate limits depend on your subscription plan. Plan-gated features such as AI execution and predictive analytics require both the appropriate scope and an eligible plan tier.

All key management — creation, scope selection, revocation, and webhook registration — happens in Settings → API. The OpenAPI reference at /api/docs is the authoritative source for endpoint paths, request schemas, and response formats.

Purpose

Agencies use the API to synchronize client data with CRM systems, trigger automations from external events, publish reports programmatically, and build custom internal tools on top of Auroranexis operational data. Webhooks complement the API by pushing event notifications to your endpoints when platform events occur.

The API is designed for server-to-server integration. Keys should be treated as sensitive credentials with the same care as passwords or integration secrets. Never embed keys in client-side JavaScript, mobile applications, or public repositories.

Rate limits protect platform stability for all customers. Monitor usage in Settings → API and Settings → Usage, and implement backoff strategies in your integration code when limits are approached.

Core Concepts

API key — a bearer token that authenticates requests on behalf of your organization.
Scope — a permission label that limits a key to specific read or write operations.
Base URL — the HTTPS origin for all API requests to your workspace.
Webhook endpoint — a URL registered to receive HTTPS POST event deliveries.
Rate limit — a per-organization cap on request frequency to protect platform stability.
Plan gating — certain endpoints require features enabled on your subscription tier.
Example keys — documentation samples such as ax_live_example_key_abc123 are not valid credentials.

Features

Organization-scoped REST endpoints for clients, reports, risks, incidents, automation, and more.
Granular scope selection when creating API keys in Settings → API.
Outbound webhook registration for platform event notifications.
Interactive OpenAPI reference at /api/docs with schema definitions.
Usage and rate limit visibility in Settings → API and Settings → Usage.
Personal and workspace-wide key types depending on integration needs.

Available scopes

Grant only the scopes your integration requires. Each scope pair follows a resource.action pattern. Keys with write scopes can modify data — apply least privilege.

clients.read / clients.write — client records and metadata.
reports.read / reports.write — reports, templates, and publishing.
risks.read / risks.write — risk register entries.
incidents.read / incidents.write — incident records and status.
automation.read / automation.write — workflow definitions and executions.
integrations.read / integrations.write — connector configuration.
webhooks.write — register and manage outbound webhook endpoints.
activity.read — workspace activity feed.
billing.read — subscription and usage summaries (read-only).
settings.read — non-sensitive settings visibility.
health.read — health and monitoring summaries.
ai.execute / predictive.read — plan-gated intelligence features.

Step-by-step usage

Create an API key

Open Settings → API.
Click Create key and enter a descriptive name identifying the integration.
Select only the scopes required for the integration's operations.
Copy the key immediately when displayed — it cannot be retrieved again.
Store the key in your secrets manager or integration configuration.

Make an API request

Confirm your key has the required scope for the target endpoint.
Consult /api/docs for the correct path, method, and request body schema.
Send an HTTPS request to the appropriate /api/v1/ path.
Include the Authorization header with your key as a Bearer token.
Handle response status codes and parse the JSON response body.

Register a webhook endpoint

Open Settings → API and navigate to webhook configuration.
Register your HTTPS endpoint URL.
Select the event types your receiver should handle.
Ensure your endpoint accepts POST requests and responds with a 2xx status.
Monitor delivery status and address failures promptly.

Handle rate limits

Implement exponential backoff when receiving HTTP 429 responses.

Best Practices

Apply least-privilege scope selection — never grant write scopes unless the integration requires them.
Use workspace keys for shared services; personal keys for individual scripts or development.
Rotate keys periodically and revoke unused keys immediately.
Implement idempotent handlers for webhook receivers to safely process duplicate deliveries.
Log API errors with correlation IDs from response headers when available.
Use the OpenAPI reference at /api/docs as the source of truth for endpoint behavior.
Never expose API keys in client-side JavaScript, mobile apps, or public repositories.
Test integrations against a dedicated key with minimal scopes before granting production access.

Examples

Marketing agency

A marketing agency registers https://integrations.example.com/auroranexis/events as a webhook endpoint with events for report.published and incident.created. When a report is published, Auroranexis sends an HTTPS POST with a JSON payload. The receiver validates the request, processes the event idempotently, and returns HTTP 200. Failed deliveries appear in webhook logs for investigation.

AI automation agency

An automation agency connects a workflow engine to Auroranexis using scoped API keys. The admin creates a key with clients.read and incidents.write scopes so failed automation runs can open incidents automatically. POST requests include client ID, severity, and a description referencing the workflow run ID. Write scopes are limited to incidents — report and billing endpoints remain unreachable from the integration service account.

MSP

An MSP syncs client names and status to ConnectWise nightly. The admin creates a key named CRM Sync in Settings → API with only the clients.read scope. The integration sends GET /api/v1/clients with Authorization: Bearer ax_live_example_key_abc123. The response JSON array is parsed and upserted into the CRM. No write scopes are granted because the sync is one-directional.

Consultancy

A small consultancy builds an internal dashboard showing subscription usage against plan limits. The owner creates a read-only key with billing.read scope in Settings → API. A nightly script fetches usage summaries and displays them alongside client counts from a separate clients.read key. Write scopes are intentionally excluded from both keys.

Enterprise deployment

An MSSP's monitoring stack auto-creates incidents when thresholds are breached across eighty enterprise clients. The admin creates a dedicated key with incidents.write scope and documents rate-limit headroom in Settings → Enterprise before enabling production traffic. POST requests to /api/v1/incidents include title, severity, client ID, and description fields. A 201 response returns the new incident ID for tracking in the external monitoring dashboard.

Troubleshooting

Common API issues

Problem	Cause	Solution
401 Unauthorized on API request	Key revoked, malformed, or missing from Authorization header	Verify the Bearer token format and confirm the key is active in Settings → API.
403 Forbidden on API request	Key lacks required scope or plan does not include the feature	Create a new key with the needed scope or upgrade your plan if the feature is plan-gated.
404 Not Found for resource	Incorrect resource ID or endpoint path	Verify the path and ID against /api/docs; confirm the resource exists in your workspace.
429 Too Many Requests	Request rate exceeds plan limit	Implement exponential backoff, reduce call frequency, and review usage in Settings → Usage.
Webhook deliveries failing

FAQ

Where do I find endpoint documentation?: The interactive OpenAPI reference at /api/docs provides full endpoint details, schemas, and examples. Access it after signing in or from Settings → API.
Can I retrieve an API key after creating it?: No. Keys are displayed once at creation. If lost, revoke the key and create a new one with the same scopes.
What rate limits apply to my workspace?: Rate limits vary by plan and protect platform stability. Review usage in Settings → API and Settings → Usage. Contact support or request enterprise limits if your integration requires sustained higher throughput.
Do webhooks require a specific scope?: Registering webhook endpoints requires the webhooks.write scope on the API key used for registration. Receiving webhook deliveries does not require an API key on your endpoint, but you should validate incoming requests according to your integration design.
Are example keys in documentation real?: No. Documentation shows sample keys such as ax_live_example_key_abc123. Never use example values in production integrations.
Can I use the API on the Professional plan?: API access and rate limits depend on your subscription tier. Review Settings → API for availability and consult /api/docs for plan-gated endpoints such as ai.execute.

Need help?

Contact support@auroranexis.com for onboarding support, billing questions, or product guidance. Include your workspace name, the module you are working in, and a brief description of your goal so we can respond efficiently.