Developers & API

The ASHR.work API

A read-only public API for product & module metadata. OpenAPI 3.1, a Swagger reference, RFC 9457 errors, cursor pagination, and X-Request-Id on every response. Anonymous-first — no key needed to read.

Interactive reference OpenAPI 3.1 (JSON)

Quickstart

Every endpoint is a plain GET. Base URL https://ashr.work/api.

# List available modules
curl -s https://ashr.work/api/v1/modules?status=available | jq

# One module
curl -s https://ashr.work/api/v1/modules/leave-management | jq

# Full capabilities manifest
curl -s https://ashr.work/api/v1/capabilities | jq

# With a Demystify API key (needed only for scoped endpoints)
curl -s -H "Authorization: Bearer dmk_live_..." https://ashr.work/api/v1/modules | jq

Endpoints

GET	/v1/health	Liveness check.
GET	/v1/capabilities	Full capabilities manifest (product, modules, surfaces).
GET	/v1/modules?status=available&limit=50	List modules (cursor-paginated).
GET	/v1/modules/{slug}	One module by slug.

Tenant data endpoints

Read your own workspace’s data with a key that carries the resource’s scope. Every response is tenant-scoped to the key; each has a list and a /{id} variant.

GET	/v1/whoami	—	The current key’s id, env and scopes.
GET	/v1/employees	employees:read	List employees (list + /{id}).
GET	/v1/leave-requests	leave:read	Leave requests (list + /{id}).
GET	/v1/leave-types	leave:read	Leave types.
GET	/v1/holidays	holidays:read	Holiday calendar.
GET	/v1/assets	assets:read	Asset register.
GET	/v1/job-openings	recruitment:read	Recruitment job openings.
GET	/v1/helpdesk-tickets	helpdesk:read	Helpdesk tickets.
GET	/v1/surveys	surveys:read	Surveys.
POST	/v1/leave-requests	leave:write	Apply for leave (idempotent). Also /{id}/approve\|reject\|cancel.
POST	/oauth/token	—	OAuth2: client_credentials + refresh_token grants.

Guides

Using the API — keys, scopes, pagination, idempotency, errors
API keys & OAuth2 — create, rotate, refresh tokens
Webhooks — events + HMAC signature verification

API keys

Keys are dmk_live_ / dmk_test_, sent as a Bearer token, hashed at rest, scoped per module, rotatable and revocable. The metadata API is anonymous; keys unlock your tenant data. Admins generate and manage keys in-app under Admin → Settings → Developer & API.

Import anywhere

Point Postman, Insomnia, Swagger UI or Scalar at /api/openapi.json, or grab the Postman collection. For agents, see /for-agents and the MCP server.