Tenant-scoped integrations live under /v1/integrations/*. Configure them in Settings → Integrations.

Figma

Method	Path	Purpose
GET	`/v1/integrations/figma/authorize`	Start OAuth
GET	`/v1/integrations/figma/callback`	OAuth callback
GET	`/v1/integrations/figma/connection`	Connection status
DELETE	`/v1/integrations/figma/connection`	Disconnect
POST	`/v1/integrations/figma/frames`	List frames
POST	`/v1/integrations/figma/import`	Import into design review

Slack

Method	Path	Purpose
GET	`/v1/integrations/slack/authorize`	Start OAuth
GET	`/v1/integrations/slack/callback`	OAuth callback
GET	`/v1/integrations/slack/connection`	Connection + defaults
PATCH	`/v1/integrations/slack/connection`	Update default channel
DELETE	`/v1/integrations/slack/connection`	Disconnect
GET	`/v1/integrations/slack/channels`	List workspace channels
PATCH	`/v1/projects/:id/slack-channel`	Per-project channel override

Outbound webhooks

Agency-configured HTTPS endpoints receive the same event catalog as Slack. Payloads are signed.

Method	Path	Purpose
GET	`/v1/integrations/webhooks`	List endpoints
POST	`/v1/integrations/webhooks`	Create endpoint
PATCH	`/v1/integrations/webhooks/:id`	Update
DELETE	`/v1/integrations/webhooks/:id`	Delete

Event catalog

Event	When
`ticket.created`	New ticket
`ticket.updated`	Ticket status / fields change
`design.review_requested`	Review requested (incl. guest share)
`design.review_decided`	Approve or request changes
`deal.won`	Pipeline deal converted to project
`digest.waiting`	Catalogued; scheduler not wired yet

Signature verification

Each delivery includes:

X-Felagar-Timestamp - Unix seconds
X-Felagar-Signature - HMAC-SHA256(secret, \${timestamp}.${rawBody}`)`

Reject requests with stale timestamps. Compare signatures with a constant-time check.

import crypto from 'node:crypto'

function verifyFelagarWebhook(rawBody, timestamp, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  )
}

Agent actions (MCP audit)

MCP tool calls can be persisted for visibility in Settings → MCP:

Method	Path	Purpose
GET	`/v1/agent-actions`	Recent agent / tool actions
POST	`/v1/agent-actions`	Record an action (MCP / internal)

Scopes enforced on MCP tools include tickets, projects, designs, time, and companies (Client Vault / pulse).

Agency assistant (staff session)

In-app AI chat for Client Vault Q&A. Staff session only (not public API-key chat by default).

Method	Path	Purpose
GET/POST	`/v1/assistant/threads`	List / create threads (optional `companyId`)
GET	`/v1/assistant/threads/:id`	Thread + messages
POST	`/v1/assistant/threads/:id/messages`	Send message (`?stream=1` for SSE)
DELETE	`/v1/assistant/threads/:id`	Archive thread
GET	`/v1/assistant/settings`	Hosted vs BYOK status
PUT	`/v1/assistant/settings`	Self-host BYOK (owner/admin)
POST	`/v1/assistant/settings/test`	Test provider connection

Integrations & webhooks