Build on the NextEAM API.

# 1. Sign in. The token is scoped to your workspace and your user.
curl -s -X POST https://<workspace>.nexteam.me/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"you@example.com","password":"..."}'
# -> {"accessToken":"eyJ...","user":{...}}

# 2. Call the API with it.
curl -s "https://<workspace>.nexteam.me/api/work-orders?status=OPEN&pageSize=50" \
  -H "Authorization: Bearer eyJ..." \
  -H "Accept: application/json"
# -> {"items":[...],"total":312,"page":1,"pageSize":50}

const base = 'https://<workspace>.nexteam.me/api';

const { accessToken } = await fetch(`${base}/auth/login`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email, password }),
}).then((r) => r.json());

const page = await fetch(`${base}/work-orders?status=OPEN&pageSize=50`, {
  headers: { Authorization: `Bearer ${accessToken}` },
}).then((r) => r.json());

console.log(`${page.total} open work orders`);

import requests

base = "https://<workspace>.nexteam.me/api"
token = requests.post(
    f"{base}/auth/login",
    json={"email": email, "password": password},
).json()["accessToken"]

page = requests.get(
    f"{base}/work-orders",
    params={"status": "OPEN", "pageSize": 50},
    headers={"Authorization": f"Bearer {token}"},
).json()

print(f"{page['total']} open work orders")

POST https://your-app.example.com/webhooks/nexteam HTTP/1.1
Content-Type: application/json
X-Webhook-Signature: sha256=3f1a...   (HMAC-SHA256 of the raw body, keyed with your secret)

{
  "eventType": "work_order.completed",
  "tenantId": "...",
  "occurredAt": "2026-09-22T08:14:22.110Z",
  "payload": { ... }
}

There is no official SDK. The API is plain JSON over HTTPS, so any HTTP client works; the examples above are exactly what the NextEAM frontend itself does.

An org admin subscribes an endpoint to events at Admin → Webhooks (POST /api/admin/webhooks with name, url and eventTypes). The signing secret is shown once at creation and can be rotated at POST /api/admin/webhooks/:id/regenerate-secret.

Every delivery is signed: X-Webhook-Signature carries sha256= followed by the HMAC-SHA256 of the raw request body, keyed with the subscription secret. Verify it before trusting the payload.

import { createHmac, timingSafeEqual } from 'node:crypto';

// rawBody is the request body BEFORE any JSON parsing.
const expected =
  'sha256=' + createHmac('sha256', secret).update(rawBody).digest('hex');
const given = String(req.headers['x-webhook-signature'] ?? '');
const ok =
  given.length === expected.length &&
  timingSafeEqual(Buffer.from(given), Buffer.from(expected));

A non-2xx answer or a 10-second timeout is retried after 1, 5, 15 and 60 minutes and then 4 hours (five attempts over roughly five hours) and then the delivery is marked FAILED. Every attempt is listed at GET /api/admin/webhooks/:id/deliveries, and POST /api/admin/webhooks/:id/test-fire sends a synthetic work_order.created so you can prove a receiver before a real event reaches it.

Endpoints that resolve to private, loopback or link-local addresses are refused, and a delivery that follows a redirect to another origin drops its signature header.

• API, per IP address

  Limit

  600 requests / minute

• Sign-in, per account

  Limit

  5 attempts / 15 minutes

• BI feed, per IP address

  Limit

  300 requests / minute

Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; an exceeded limit answers 429 with a Retry-After header. Validation failures are 400 and name the offending fields; a missing or expired token is 401; a role without the permission is 403; a unique-constraint clash (a duplicate code, say) is 409.

Every integration NextEAM ships (ERP posting, ticket sync, BI dashboards) uses the surface on this page and nothing else. That is the guarantee: what you can build is what we build with.

• ERP (SAP, Oracle Fusion)

  Requisitions, purchase orders and vendor invoices are ordinary resources: read them with a token, write cost-centre alignment back with PATCH, and react to purchase_requisition.approved or invoice.issued through a webhook. The ERP connector itself is scoped and delivered with you during onboarding.

• Service desk and IT

  Tickets, IT assets and discovery runs are all reachable under /api, so an inventory agent can push what it finds the same way the CSV import does.

• BI and reporting

  Point Power BI, Metabase or Excel at the API-key feed for live, workspace-scoped extracts, with no export files to schedule.