Figma, Slack, Linear, GitHub Issues, outbound webhooks, and agent action audit endpoints.

Tenant-scoped integrations live under /v1/integrations/*. Configure them in Settings → Integrations.

Figma

Method	Path	Purpose
GET	`/v1/integrations/figma/authorize`	Start OAuth
GET	`/v1/integrations/figma/callback`	OAuth callback
GET	`/v1/integrations/figma/connection`	Connection status
DELETE	`/v1/integrations/figma/connection`	Disconnect
POST	`/v1/integrations/figma/frames`	List frames
POST	`/v1/integrations/figma/import`	Import into deliverable review

Linear

Method	Path	Purpose
GET	`/v1/integrations/linear/authorize`	Start OAuth
GET	`/v1/integrations/linear/callback`	OAuth callback
GET	`/v1/integrations/linear/connection`	Connection status
POST	`/v1/integrations/linear/connection`	Connect with API key
DELETE	`/v1/integrations/linear/connection`	Disconnect
GET	`/v1/integrations/linear/teams`	List workspace teams
GET	`/v1/integrations/linear/projects`	List team projects (`?teamId=`)

GitHub Issues

Method	Path	Purpose
GET	`/v1/integrations/github/authorize`	Start OAuth
GET	`/v1/integrations/github/callback`	OAuth callback
GET	`/v1/integrations/github/connection`	Connection status
POST	`/v1/integrations/github/connection`	Connect with personal access token
DELETE	`/v1/integrations/github/connection`	Disconnect
GET	`/v1/integrations/github/repos`	List accessible repositories

Project development bindings

Bind a Felagar project to a Linear team and/or GitHub repo, then create or link issues. Staff only.

Method	Path	Purpose
GET	`/v1/projects/:id/dev`	Bindings + linked issues
PUT	`/v1/projects/:id/dev/bindings`	Bind Linear team or GitHub repo
DELETE	`/v1/projects/:id/dev/bindings/:provider`	Remove a binding (`linear` or `github`)
GET	`/v1/projects/:id/dev/issues`	List open issues from bound providers
POST	`/v1/projects/:id/dev/issues`	Create an issue (`provider`, `title`, optional `cardId`)
POST	`/v1/projects/:id/dev/links`	Link an existing issue by URL or identifier
DELETE	`/v1/projects/:id/dev/links/:linkId`	Unlink

Slack

Method	Path	Purpose
GET	`/v1/integrations/slack/authorize`	Start OAuth
GET	`/v1/integrations/slack/callback`	OAuth callback
GET	`/v1/integrations/slack/connection`	Connection + defaults
PATCH	`/v1/integrations/slack/connection`	Update default channel
DELETE	`/v1/integrations/slack/connection`	Disconnect
GET	`/v1/integrations/slack/channels`	List workspace channels
PATCH	`/v1/projects/:id/slack-channel`	Per-project channel override

Outbound webhooks

Agency-configured HTTPS endpoints receive the same event catalog as Slack. Payloads are signed.

Method	Path	Purpose
GET	`/v1/integrations/webhooks`	List endpoints
POST	`/v1/integrations/webhooks`	Create endpoint
PATCH	`/v1/integrations/webhooks/:id`	Update
DELETE	`/v1/integrations/webhooks/:id`	Delete

Event catalog

Event	When
`ticket.created`	New ticket
`ticket.updated`	Ticket status / fields change
`deliverable.review_requested`	Review requested (incl. guest share)
`deliverable.review_decided`	Approve or request changes
`deal.won`	Pipeline deal converted to project
`digest.waiting`	Catalogued; scheduler not wired yet

Signature verification

Each delivery includes:

X-Felagar-Timestamp - Unix seconds
X-Felagar-Signature - HMAC-SHA256(secret, \${timestamp}.${rawBody}`)`

Reject requests with stale timestamps. Compare signatures with a constant-time check.

import crypto from 'node:crypto'

function verifyFelagarWebhook(rawBody, timestamp, signature, secret) {
  const expected = crypto
    .createHmac('sha256', secret)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex')
  return crypto.timingSafeEqual(
    Buffer.from(expected),
    Buffer.from(signature),
  )
}

Agent actions (MCP audit)

MCP tool calls can be persisted for visibility in Settings → MCP:

Method	Path	Purpose
GET	`/v1/agent-actions`	Recent agent / tool actions
POST	`/v1/agent-actions`	Record an action (MCP / internal)

Scopes enforced on MCP tools include tickets, projects, deliverables, time, and companies (Client Vault / pulse).

Agency assistant (staff session)

In-app AI chat for Client Vault Q&A. Staff session only (not public API-key chat by default).

Method	Path	Purpose
GET/POST	`/v1/assistant/threads`	List / create threads (optional `companyId`)
GET	`/v1/assistant/threads/:id`	Thread + messages
POST	`/v1/assistant/threads/:id/messages`	Send message (`?stream=1` for SSE)
DELETE	`/v1/assistant/threads/:id`	Archive thread
GET	`/v1/assistant/settings`	Hosted vs BYOK status
PUT	`/v1/assistant/settings`	Self-host BYOK (owner/admin)
POST	`/v1/assistant/settings/test`	Test provider connection

Integrations & webhooks