GearDock includes a versioned REST API and inbound and outbound webhook contracts for approved enterprise integrations. Public production activation is not enabled by this documentation; access is configured per organization during onboarding.
Authentication and Scope
- API credentials are scoped to one organization and an explicit capability set.
- Credentials are stored and displayed as protected references rather than returned in full after creation.
- Every request is evaluated against the connected organization's current authorization.
- API activity cannot read another organization's products, documents, jobs, reviews, exports, or delivery evidence.
Request Reliability
- Idempotency key
- A caller-supplied key that lets GearDock recognize a safe replay instead of applying the same accepted operation twice.
- Rate limit
- A bounded request allowance that protects the organization, provider, and shared execution plane. Clients should respect the returned retry guidance.
- Checkpoint
- A durable record of completed work used by background execution to resume from a safe boundary after interruption.
- Delivery evidence
- The append-only record of what was attempted, its organization and destination scope, outcome, retry state, and relevant correlation identifiers.
Webhook Behavior
Inbound webhooks authenticate the sender, reject replays, and hand accepted work to bounded background execution. Outbound deliveries are signed, retried according to policy, and become visible for operator review if they exhaust the allowed attempts.
Do Not Send Patient Information
Customer Configuration
Endpoint access, credentials, allowed network destinations, field mappings, rate expectations, webhook verification, and failure ownership are configured and qualified with each customer. Exact endpoint reference material is supplied only for an approved implementation; this public overview does not expose internal routes or operational runbooks.