Felagar
DE
ENEnglishNLNederlandsDEDeutschHRHrvatskiESEspañol
Loslegen

Referenz

Integrations & webhooks

Figma, Slack, outbound webhooks, and agent action audit endpoints.

ClaudeChatGPTCursor

Tenant-scoped integrations live under /v1/integrations/*. Configure them in Settings → Integrations.

Figma

Method Path Purpose
GET /v1/integrations/figma/authorize Start OAuth
GET /v1/integrations/figma/callback OAuth callback
GET /v1/integrations/figma/connection Connection status
DELETE /v1/integrations/figma/connection Disconnect
POST /v1/integrations/figma/frames List frames
POST /v1/integrations/figma/import Import into design review

Slack

Method Path Purpose
GET /v1/integrations/slack/authorize Start OAuth
GET /v1/integrations/slack/callback OAuth callback
GET /v1/integrations/slack/connection Connection + defaults
PATCH /v1/integrations/slack/connection Update default channel
DELETE /v1/integrations/slack/connection Disconnect
GET /v1/integrations/slack/channels List workspace channels
PATCH /v1/projects/:id/slack-channel Per-project channel override

Outbound webhooks

Agency-configured HTTPS endpoints receive the same event catalog as Slack. Payloads are signed.

Method Path Purpose
GET /v1/integrations/webhooks List endpoints
POST /v1/integrations/webhooks Create endpoint
PATCH /v1/integrations/webhooks/:id Update
DELETE /v1/integrations/webhooks/:id Delete

Event catalog

Event When
ticket.created New ticket
ticket.updated Ticket status / fields change
design.review_requested Review requested (incl. guest share)
design.review_decided Approve or request changes
deal.won Pipeline deal converted to project
digest.waiting Catalogued; scheduler not wired yet

Signature verification

Each delivery includes:

  • X-Felagar-Timestamp - Unix seconds
  • X-Felagar-Signature - HMAC-SHA256(secret, \${timestamp}.${rawBody}`)`

Reject requests with stale timestamps. Compare signatures with a constant-time check.

import crypto from 'node:crypto'

function verifyFelagarWebhook(rawBody, timestamp, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  )
}

Agent actions (MCP audit)

MCP tool calls can be persisted for visibility in Settings → MCP:

Method Path Purpose
GET /v1/agent-actions Recent agent / tool actions
POST /v1/agent-actions Record an action (MCP / internal)

Scopes enforced on MCP tools include tickets, projects, designs, time, and companies (Client Vault / pulse).

Agency assistant (staff session)

In-app AI chat for Client Vault Q&A. Staff session only (not public API-key chat by default).

Method Path Purpose
GET/POST /v1/assistant/threads List / create threads (optional companyId)
GET /v1/assistant/threads/:id Thread + messages
POST /v1/assistant/threads/:id/messages Send message (?stream=1 for SSE)
DELETE /v1/assistant/threads/:id Archive thread
GET /v1/assistant/settings Hosted vs BYOK status
PUT /v1/assistant/settings Self-host BYOK (owner/admin)
POST /v1/assistant/settings/test Test provider connection