Developers & API

The ASHR.work API

OpenAPI 3.1, a Swagger reference, RFC 9457 errors, cursor pagination, and X-Request-Idon every response. Product & module metadata is anonymous and read-only — no key needed. A scoped key reads your tenant's data and, for employees, leave, documents and recruitment, takes real actions on it.

Interactive reference OpenAPI 3.1 (JSON)

Quickstart

Every endpoint is a plain GET. Base URL https://ashr.work/api.

# List available modules
curl -s https://ashr.work/api/v1/modules?status=available | jq

# One module
curl -s https://ashr.work/api/v1/modules/leave-management | jq

# Full capabilities manifest
curl -s https://ashr.work/api/v1/capabilities | jq

# With a Demystify API key (needed only for scoped endpoints)
curl -s -H "Authorization: Bearer dmk_live_..." https://ashr.work/api/v1/modules | jq

Endpoints

GET	/v1/health	Liveness check.
GET	/v1/capabilities	Full capabilities manifest (product, modules, surfaces).
GET	/v1/modules?status=available&limit=50	List modules (cursor-paginated).
GET	/v1/modules/{slug}	One module by slug.

Tenant data endpoints

Read your own workspace’s data with a key that carries the resource’s scope. Every response is tenant-scoped to the key; each has a list and a /{id} variant.

GET	/v1/whoami	—	The current key’s id, env and scopes.
GET	/v1/employees	employees:read	List employees (list + /{id}).
GET	/v1/leave-requests	leave:read	Leave requests (list + /{id}).
GET	/v1/leave-types	leave:read	Leave types.
GET	/v1/holidays	holidays:read	Holiday calendar.
GET	/v1/assets	assets:read	Asset register.
GET	/v1/attendance-records	attendance:read	Daily attendance rollups (list + /{id}).
GET	/v1/job-openings	recruitment:read	Recruitment job openings.
GET	/v1/helpdesk-tickets	helpdesk:read	Helpdesk tickets.
GET	/v1/surveys	surveys:read	Surveys.
GET	/v1/feedback-requests	reviews:read	Feedback-on-demand requests (never the answers).
GET	/v1/skills	talent:read	The skill library (never assessments).
GET	/v1/pulse-surveys	surveys:read	Pulse definitions (never responses).
GET	/v1/comp-cycles	payroll:read	Compensation review cycles (never proposals).
POST	/oauth/token	—	OAuth2: client_credentials + refresh_token grants.

Write endpoints

A key with the write scope can act on your workspace, not just read it — the same employee/leave/document/recruitment actions available in-app. Every write is idempotent where the operation allows it and audited exactly like an in-app action.

POST	/v1/employees	employees:write	Create an employee.
PATCH	/v1/employees/{id}	employees:write	Update an employee.
POST	/v1/leave-requests	leave:write	Apply for leave (idempotent).
POST	/v1/leave-requests/{id}/approve	leave:approve	Approve a leave request.
POST	/v1/leave-requests/{id}/reject	leave:approve	Reject a leave request.
POST	/v1/leave-requests/{id}/cancel	leave:write	Cancel a leave request.
POST	/v1/attendance-records/{id}/regularise	attendance:write	Approve or reject a pending attendance regularisation.
POST	/v1/documents	documents:write	Generate a document from a template.
POST	/v1/job-openings	recruitment:write	Open a job requisition.
PATCH	/v1/job-openings/{id}	recruitment:write	Update a job requisition.
POST	/v1/candidates	recruitment:write	Add a candidate.
PATCH	/v1/candidates/{id}	recruitment:write	Move or update a candidate.

Guides

Using the API — keys, scopes, pagination, idempotency, errors
API keys & OAuth2 — create, rotate, refresh tokens
Webhooks — events + HMAC signature verification

API keys

Keys are dmk_live_ / dmk_test_, sent as a Bearer token, hashed at rest, scoped per module, rotatable and revocable. The metadata API is anonymous; a key unlocks your tenant's data and, with the right scope, actions on it. Admins generate and manage keys in-app under Admin → Settings → Developer & API.

Import anywhere

Point Postman, Insomnia, Swagger UI or Scalar at /api/openapi.json, or grab the Postman collection. For agents, see /for-agents and the MCP server.