Browse the docs
DocsDevelopers / APIDevelopers

API overview

Cadence exposes a versioned REST API at /api/v1 so you can read and write the same time entries, clients, projects, and reports the desktop app uses.

The Cadence API is a small, predictable REST surface over the same data your team tracks in the desktop app: time entries, the client/project/task/tag catalogue, members, reports, integrations, and webhooks. Everything speaks JSON, and every request is scoped to a single organisation.

Base URL and versioning

All endpoints live under /api/v1 on the site origin. In production that is:

http
https://cadencetime.co/api/v1

The version is part of the path, so a future /api/v2 can ship without breaking existing integrations. Every response also carries a Cadence-API-Version header and an x-request-id you can quote when asking us about a specific call.

Conventions

  • Requests and responses are JSON. Send Content-Type: application/json on any request with a body.
  • Reads are GET; creates are POST (returning 201); partial updates are PATCH. The API never uses PUT.
  • A successful single-resource response wraps the object under a data key. List endpoints return data as an array, with keyset pagination on the larger collections.
  • Timestamps are ISO-8601 strings (for example 2026-06-17T09:30:00Z). IDs are UUIDs.

Everything is scoped to one organisation

An API key is bound to exactly one organisation and one member of that organisation. The key can only ever read or write data inside that organisation: the same row-level isolation that keeps teams apart in the app applies identically to the API. There is no account-wide or cross-organisation key. See data isolation for how that boundary is enforced, and authentication for how keys carry it.

Read or write only what the key allows
Beyond the organisation boundary, a key only does what its scopes permit, and never more than the member it acts as is allowed to do. A read-only key cannot write; a key whose member is not an admin cannot reach admin-only endpoints. Both gates apply on every request.

Ready to make a call? Start with authentication, then browse the resources and endpoints.