External API Opportunities

The current API surface provides a strong foundation for a formal external ecosystem, but the Partner API must be deliberately scoped.

Strong first partner domains

• tenant/location discovery
• resource/service catalogue and availability
• booking create/read/cancel
• order create/read/status
• payment/payable status
• CRM client/service/quote/order/task subsets
• invoice/document metadata and controlled retrieval
• signed lifecycle webhooks

Restricted domains

HR and Finance should start with purpose-specific connectors/export contracts, not broad CRUD.

Requirements before Partner API GA

OAuth/client credentials or scoped keys, tenant app consent, scopes, rotation/revocation, rate limits, stable errors, idempotency, OpenAPI, sandbox tenants, signed/versioned webhooks, audit/usage logs, SDK/examples and deprecation policy.