Developers
API Reference
BOS exposes a REST API so you can integrate your own tools and automate workflows. Everything you can do in the app, you can do through the API — with the same governance and audit.
Base URL & versioning
All endpoints are served under a versioned prefix. The current version is v1:
https://<your-api-host>/api/v1Same rules as the app
The module endpoint pattern
Every module follows the same predictable pattern. The module prefixes are /crm, /fin, /hr, /ops, /legal, and /strat.
| Method | Endpoint | Description |
|---|---|---|
| GET | /stats | Dashboard statistics |
| GET | /entities | List records (pagination & filters) |
| POST | /entities | Create a record |
| GET | /entities/:id | Get a single record |
| PUT | /entities/:id | Update a record |
| DELETE | /entities/:id | Delete or deactivate a record |
For example, list CRM leads with GET /api/v1/crm/leads or create one with POST /api/v1/crm/leads.
Governance endpoints
/workflows— execute, approve, reject, and list pending actions./approvals— the full approval lifecycle./audit— browse events and verify audit integrity./settings— roles, permissions, ABAC, SoD, and team members./data— import, export, and DPDP data requests.
Rate limits
To keep the platform fast and fair, requests are rate limited:
- 100 requests/minute globally per client.
- 20 requests/minute on authentication endpoints.
If you exceed a limit you'll receive an HTTP 429 response — back off and retry after a short delay.
Errors
Errors return a standard HTTP status code and a JSON body with a machine-readable code (for example AUTH_USER_DEACTIVATED) and a human-readable message, so you can handle them programmatically.
Next steps