API and API token

FlexiProject offers a REST API through which another system can read and change the organization’s data — feed a BI report, synchronize projects with an ERP or automate a repetitive task. The full description of the endpoints is at developers.flexi-project.com.

To call the API you need a personal access token (API token). You create it yourself in your profile, on the API tab, and it works with your permissions: the API shows exactly the data you see in the application and nothing more.

Personal access token

Who can create a token

A token is created, for their own account, by a user with a Full license (see Licenses) and by a system administrator; the API tab is visible only to them. No administrator permission is needed. The token carries its owner’s permissions, so it reaches the same projects and fields the owner sees in the application. Two people with different roles get different results from the same request.

A token stops working when the account is deactivated, removed from the organization or locked, so you do not need to clean up tokens when someone leaves.

Creating a token

1. Open the avatar menu, choose User profile and go to the API tab (see User profile).
2. Click New token.
3. Enter a Name — up to 100 characters. The name should say which integration the token serves, because it is the only way to tell your tokens apart later.
4. Set the Expiration date. The earliest is tomorrow, the latest 365 days from today, and the field opens at 30 days. The token expires at the end of the chosen day.
5. Click Create token.

Copy the token right away

The Personal access token created window shows the full value only once, with a warning: Copy the token and store it somewhere safe — once you close this window it can no longer be read. The Copy button copies the value to the clipboard, and you paste it straight into the system that will use it. After you close the window nobody can recover the value — not you, not an administrator, not support. If you lose a token, delete it and create a new one.

Token list

The API tab lists your tokens in the columns Name, Token, Created and Expires. The Token column shows only the first characters of the value — enough to match a token with the one saved in an integration.

The Expires column warns in advance: a token expiring within seven days carries a tag with the number of days left, one expiring today shows expires today, and an expired one shows expired. An expired token stays on the list until you delete it, but it no longer authenticates anything.

You can have up to ten active tokens at a time. Once the limit is reached, the application refuses to create another, with the message You already have 10 active personal access tokens. Delete an unused token to create a new one. Expired tokens do not count towards the limit.

Deleting a token

The trash icon in a token’s row deletes it after confirmation. The application warns that integrations using it will stop working immediately — and they do, at their next request. Deletion cannot be undone; replacing a token always means a new token with a new value.

Using a token

An API token is not sent with every request. You exchange it once for an access token and use that access token from then on.

Send a POST to /api/user/token/personal with your e-mail address and the token value:

POST /api/user/token/personal
Content-Type: application/json

{ "email": "anna.kowalska@example.com", "token": "fpat_…" }

The response contains the access_token, its type, the identifier of the organization the token belongs to and the number of seconds it is valid for. Send the access token in the Authorization header of subsequent calls, and repeat the exchange when it expires.

The e-mail address must belong to the account that created the token, and the token itself decides which organization you get into — if you work in more than one, create a separate token in each.

Repeated failed attempts are limited: after ten failed attempts for the same e-mail address, further ones are rejected for fifteen minutes. If an integration suddenly starts getting refusals in bulk, check the saved value instead of retrying in a loop.

Exchanging an API token also works when password sign-in is switched off, because it is not a person signing in (see Sign-in methods).