Skip to content

Available

Webhooks and the public API

Read and write CalSpark data from your own scripts, and have CalSpark post to your URL when a job, customer or invoice changes. Included on the one plan, and off until an admin turns it on in Company, Features. There is no pre-built connector: this is a building block for someone who can write a small script.

Menu path: Settings, Developers. Updated .

CalSpark Settings, Developers page with a webhook endpoint and its delivery log

What it does

  • The REST API creates and reads customers, jobs, invoices (drafts), payments, team members and events, with keys you create and scope yourself.
  • Webhooks send a signed JSON event to an https URL you choose when a job is scheduled, completed or rescheduled, an invoice is paid, a payment is refunded, a lead arrives and so on. The full list of events, with example payloads, is on the developer docs.
  • A delivery log shows every attempt, the response your server gave, and lets you replay a delivery.

It does not ship with connectors. The Zapier app and QuickBooks Online sync are planned and not available (see what is planned). Slack notifications are separate and use an incoming webhook, set up under Settings, Integrations. If you want a connector that does not exist, this is what a developer would build it on.

Set it up, step by step

The API and webhooks are off until an admin turns on API and Webhooks in the Features card on the Company page. After that, everything is under Settings, Developers. Only admins can see it.

Create an API key

  1. Open Settings, then Developers, then the API keys tab.
  2. Choose Create key. Give it a name such as "Bookkeeping script". You can have up to 25 active keys.
  3. Tick scopes. Each scope is separate: customers:read does not allow creating customers. Grant only what the script needs.
  4. Optionally set an expiry date, then create the key and copy it. It starts with csk_live_ and is never shown again. If you lose it, revoke it and make another.
curl https://www.calspark.app/api/v1/me \
  -H "Authorization: Bearer csk_live_..."

Add a webhook endpoint

  1. Open the Webhook endpoints tab and choose Add endpoint. You can have up to 20.
  2. Enter the URL. It must start with https:// and be reachable from the internet. Private and internal addresses are blocked.
  3. Choose the events under Events to send. Start with one, such as job.completed.
  4. Save, then copy the signing secret (it starts with whsec_). You can show it again later with Reveal secret on the endpoint page.
  5. Open the endpoint and choose Send test event to confirm your server answers.

Signature checking is not optional in practice: anyone can post to a public URL. The step-by-step is in how to verify a CalSpark webhook signature.

Worked examples

Create a customer from a script

Send an Idempotency-Key so a retry never creates a second customer. The key is remembered for 24 hours.

curl -X POST https://www.calspark.app/api/v1/customers \
  -H "Authorization: Bearer csk_live_..." \
  -H "Idempotency-Key: web-form-2026-10-06-0042" \
  -H "Content-Type: application/json" \
  -d '{"first_name":"Dana","last_name":"Whitaker","email":"dana@example.com"}'

What a webhook delivery looks like

Every delivery is a POST with the same envelope. data.object is the job, invoice or customer, and previous_attributes holds what changed.

{
  "id": "evt_...",
  "type": "job.completed",
  "api_version": "...",
  "created": 1760000000,
  "company_id": "...",
  "data": {
    "object": { "id": "5081", "status": "completed", "...": "..." },
    "previous_attributes": { "status": "in_progress" }
  }
}

Two ideas people use first: send each completed job to a spreadsheet (guide), or post a message to your own chat tool when a large invoice is paid.

Limits you should know

Public API and webhook limits
LimitValue
Request rate120 requests per minute per key. Over it you get 429 with a Retry-After header.
Page size1 to 100 items, 25 by default, cursor based.
Active API keys25 per company.
Webhook endpoints20 per company, https only.
Delivery attemptsUp to 8 per event, backing off from 1 minute to 24 hours.
Endpoint auto-disableAfter HTTP 410, or after 7 days of continuous failure.
Signature ageReject timestamps more than 5 minutes from your clock.
Secret rotationAfter you rotate, the old secret keeps working for 24 hours.

Deliveries can arrive more than once and are not guaranteed to be instant. Use the event id to ignore repeats. The API only creates draft invoices, and the API has no export endpoint. For a one-off file, use the CSV download under Settings, Data.

Questions

Does it cost extra?

No. The API and webhooks are included on the one plan. They are off until an admin turns on API and Webhooks in Company, Features.

Can I connect it to Zapier?

The Zapier app is planned and not available. You could point a webhook at any tool that gives you an https URL to receive posts, but signature checking then depends on that tool. Read the verification guide first.

Where is the API reference?

On the developer docs, with an OpenAPI 3.1 file at /api/v1/openapi.json.

What happens if my server is down?

CalSpark retries up to 8 times over about two days. If the endpoint keeps failing for 7 days, it is disabled. Fix your server, then switch it back on with Enable on the endpoint page. Replay failed deliveries from the delivery log.

Can a key see another company's data?

No. A key belongs to one company and only sees that company's data.

Try it with your own jobs

14-day free trial. No card. $49 a month flat for up to 10 users after that.