Developers

The same employees, over an API

Everything an employee does in Slack or the console is available over REST: sessions, cited answers, tools behind the same permission ladder, and signed webhooks out. API sessions appear in the console history and audit like any other surface, because they are the same surface.

Authentication

Create an API key in Settings, Developers. Keys are shown once and stored hashed; revocation is immediate. Send it as a Bearer token.

curl https://app.pagerox.com/api/v1/sessions \
  -H "Authorization: Bearer pk_live_..." \
  -H "Content-Type: application/json" \
  -d '{"employee_id": "EMPLOYEE_ID"}'

Requests are rate limited per key origin (60 per minute). A 429 carries a Retry-After header.

Endpoints

Talking to an employee

POST /api/v1/sessions/:id/messages
{"content": "What is our refund policy for annual plans?"}

200 OK
{
  "message_id": "…",
  "content": "Annual plans are refundable within 30 days… [1]",
  "citations": [{ "n": 1, "title": "Refund policy", "source": "…" }],
  "refusal": false
}

Employees answer from your org brain with citations, or say they do not know. That contract holds on every surface, including this one.

Webhook tools

Register an endpoint of yours as a tool an employee can call: one operation, a JSON Schema for its input, and a signing secret shown once. The tool goes through the exact same grant and action-level gate as catalog tools; an L2+ call parks an approval before your endpoint ever hears about it. Private-network targets are rejected.

POST https://your-endpoint.example.com/tools/create-ticket
x-pagerox-timestamp: 1789...
x-pagerox-signature: v1=hex(hmac_sha256(secret, timestamp + "." + body))

{"title": "Follow up with Acme", "priority": "high"}

Event webhooks

Subscribe an endpoint to workspace events: proposal.created, approval.decided, tool.invoked, loop.opened, loop.closed. Payloads carry metadata only (ids, names, counts), never message content. Deliveries are signed the same way, retried with exponential backoff, and dead-lettered after five attempts; the dead-letter list is visible in Settings, Developers.

The portable employee bundle

Export any employee as pagerox.employee.bundle/v1: the versioned role config, the attributed memory ledger, and the eval golden set, as plain JSON you can read, diff, and keep. Importing a bundle creates a draft in the builder for review, never a silent hire, and never moves credentials: connections are always re-made by a human.

{
  "format": "pagerox.employee.bundle/v1",
  "employee": { "name": "Iris", "title": "Support lead" },
  "role_config": { "version": 12, "instructions": { … }, "guardrails": { … } },
  "memories": [ { "content": "…", "author_role": "manager", … } ],
  "golden_questions": [ … ]
}

The API surface is intentionally small while the platform is young. If you need an endpoint that is not here, tell us.