Use the read-only API
This reference is for the person implementing an integration. The API reads permitted records; it does not create or update cases.
The machine-readable reference is available at /api/v1/openapi on the application's host.
Create a key
An owner or manager opens Settings → Security & data → Integrations → API access and creates a read-only key. Give it a recognisable label and an expiry if needed.
Copy the key when shown. It cannot be retrieved later. Store it as a secret and send it in the Authorization header, never in a URL.
curl https://your-firm.example/api/v1/whoami \ -H "Authorization: Bearer $KEY"
Replace the example host with the application host. A key is 64 lowercase hexadecimal characters.
Endpoints and access
| Method and path | Result |
|---|---|
| GET /api/v1/whoami | Firm identity and financial-access indicator |
| GET /api/v1/cases | Case list |
| GET /api/v1/cases/{caseId} | One accessible case |
| GET /api/v1/contacts | Firm directory |
| GET /api/v1/payments | Case payment entries; requires financial access |
The key reads with its creator's current access. Location restrictions apply to cases and payments; the directory is firm-wide. Revocation, expiry or removal of the holder stops access.
The API omits Social Security numbers, birth/death dates and places, cause of death and internal notes. Use the schema for the exact fields.
Pagination
Collection requests accept updated_since, since_id and limit. The default limit is 100 and the maximum is 500.
A response includes data, next_updated_since, next_id and has_more.
For the next request, pass next_updated_since as updated_since and next_id as since_id. URL-encode the values. Preserve the timestamp string exactly, including fractional seconds; converting it through a JavaScript Date loses precision.
Continue while has_more is true. A full final page may be followed by an empty page. Do not build the cursor from a timestamp alone.
Errors
| Status | Meaning |
|---|---|
| 400 invalid_parameter | Correct the named query parameter |
| 401 unauthorized | Missing, invalid, expired, revoked or rate-limited credential, or unavailable authentication |
| 403 forbidden | Valid key lacks financial access for payments |
| 404 not_found | Case is missing, inaccessible or its identifier is invalid |
| 502 read_failed | The resource read failed |
Check HTTP status before reading data. An HTTP authentication failure is an error response, not a successful empty list.
The shared rate budget is 1,200 units per key per hour. A normal resource request uses two units, giving an effective ceiling of about 600 resource requests per hour. Use larger pages or webhooks to reduce polling.
Archived cases and voided payments carry flags. Payment amounts are positive; use entry_type to interpret refunds and other entry types.