A public API that says what it can do.

Authenticate

Settings → API and webhooks → Create API key. Amberpact shows the token once. Send it as Authorization: Bearer amb_…. Keys are stored as SHA-256 hashes.

REST

• GET /api/v1/me — workspace id, name, plan, key prefix
• GET /api/v1/contacts — up to 100 contacts
• POST /api/v1/contacts — first_name required; optional last name, email, phone, company, lead_source
• GET /api/v1/projects — recent projects with contact name and value

Webhooks

Save a URL in Settings. Amberpact POSTs JSON for contract_signed, invoice_paid, project_created, and test. Headers: X-Amberpact-Event, X-Amberpact-Signature (HMAC-SHA256 of the raw body with your signing secret).

POST /api/v1/webhook-echo is a public sink you can point at while wiring Zapier or Make. It echoes the payload and does not store it.

QuickBooks Online

Settings → QuickBooks Online stays disconnected until QBO_CLIENT_ID and QBO_CLIENT_SECRET are set. Amberpact will not invent a sync or push a fake invoice.