Overview
Create and manage organisation access tokens for the Imploy REST API.
An access token lets an external system call the Imploy API on behalf of your organisation. A token starts with imp_at_ and is sent as a Bearer token:
Authorization: Bearer imp_at_XXXX
Replace imp_at_XXXX with the token value. Treat a token like a password: anyone who has it can act within its permissions.
The API has one endpoint per operation, across clients, staff, roster, sites, finance, forms, reports, tasks, incidents and prospects. The base URL is https://app.imploy.com.au/api/integrations/v1.
Get started
Create a token
An organisation owner or a Superadmin creates it in Settings > Integrations. Choose a name, a permission for each area, and an expiry date.
Copy the secret
The secret is shown once. Store it somewhere safe.
Check the connection
Call GET /me to see the organisation and what the token can do. See Authentication.
curl "https://app.imploy.com.au/api/integrations/v1/me" \
-H "Authorization: Bearer imp_at_XXXX"
const res = await fetch("https://app.imploy.com.au/api/integrations/v1/me", {
headers: { Authorization: "Bearer imp_at_XXXX" },
});
const data = await res.json();
Token settings
When you create a token you choose:
- A name, to recognise it later.
- The permission for each area. See Permissions.
- An expiry date. By default a token expires 90 days after it is created, and the most you can set is one year.
- Whether the token can also be used as an MCP server by AI assistants, such as Claude and ChatGPT. This has no effect on the REST API.
Who changes are made as
Requests run as the organisation owner, limited by the token's permissions. Changes go through the same checks and notifications as the Imploy app, and are recorded in the organisation's activity log.
Manage a token
You can rotate, enable, disable or delete a token. Rotating issues a new secret and immediately invalidates the old one, so any system still using the old secret stops working until it is updated.
You can have up to 20 tokens. When you reach the limit, creating another returns an error.
The secret is shown only when the token is created or rotated. Copy it then and store it securely. Imploy stores only a hash of the token, so the full secret cannot be shown again.
Endpoints by area
Clients
Clients and client notes.
Staff
Staff and leave.
Roster
Shifts, appointments and imports.
Sites
Sites.
Finance
Charge metrics and billables.
Forms
Forms and submissions.
Reports
Insights, dashboards and spaces.
Tasks
Tasks, charges and notes.
Incidents
Incidents and site incidents.
Prospects
Prospects and conversion.