Public API & Webhooks

A public read API at /api/v1/* and outbound webhooks, for wiring Manuall into anything else you run.

Public read API

• RESTful JSON, Bearer-token auth.
• Read-only by design. There is no public write path to your data.
• Endpoints cover customers, jobs, estimates, and invoices (a list and a by-id detail for each).

Generating a key

1. Profile -> Public API Key -> Generate.
2. Copy it then and there. The full key (it starts mnl_pub_) is shown once; after that you only see a masked tail. Manuall stores only a hash, so it can't be recovered.
3. Send it as Authorization: Bearer your-key.

One key per user. Rotate by regenerating, which immediately retires the old key.

Outbound webhooks

Set these up in Settings -> Webhooks (Admin). Subscribe to an event and Manuall POSTs you a signed JSON payload when it happens. The events:

• customer.created
• job.created
• job.completed
• estimate.sent
• estimate.approved
• invoice.sent
• invoice.paid

Each subscription has its own signing secret. Manuall signs every payload with HMAC-SHA256 so you can verify it's really from us. Failed deliveries retry with exponential backoff.

The signing secret

The secret is shown once when you create the subscription, and once again right after you rotate it. Rotation is atomic, so payloads already in flight keep verifying until your consumer picks up the new secret.

Plan tier

The public read API is on Business. Outbound webhooks are configured by an Admin under Settings and don't need a specific tier.