Developers
Build on Kumry
Kumry gives each organisation two ways to connect other systems: API keys for calling Kumry, and signed webhooks for hearing from it.
Authentication
Create an API key for your organisation, send it as a bearer token, and understand what a key can and cannot reach.
Read moreAPI reference
Base URL, request conventions, rate limits and the errors you should handle.
Read moreWebhooks
Receive signed events when invoices are paid, bills are approved, periods close and more.
Read moreQuick start
Requests go to https://api.kumry.com with your organisation's API key in the Authorization header. A key works only for the organisation that issued it, so there is no organisation ID to pass.
curl https://api.kumry.com/contacts \
-H "Authorization: Bearer km_live_..."Keys look like km_live_… or km_test_…. The full key is shown once, when it is created; Kumry stores only a hash of it.
How it fits together
- API keys act on behalf of the person who issued them, with either read or read-and-write access. Kumry's usual permission checks apply to every request.
- Some actions stay with people. Actions that need a signed-in person to confirm them with multi-factor authentication are refused to a key, and keys cannot reach sign-in, billing, team membership or administration.
- Webhooks deliver events to an HTTPS endpoint you choose, signed with a secret only you and Kumry hold, and retried if your endpoint is unavailable.
API access is available on request
Organisation owners and admins create API keys and webhooks under Settings → Integrations. If you are building an integration and want to talk it through first, get in touch.