The REST API
Programmatic access for firms that want it.
Firm accounts can use the REST API for approved client and matter workflows. Create a scoped credential in Settings, store it in a secrets manager, and send it only over HTTPS. Never place a server credential in browser code or a shared document.
Treat webhook events as at-least-once delivery: verify the signature, reject stale or malformed requests, process idempotently, and return quickly before doing slow work. Keep a durable event record so a retry cannot create a duplicate client, invoice, or document action.
Rotate a credential immediately if it may have been exposed. Test integrations with non-client data before enabling them for live matters.