Start hereCore concepts

Core concepts

The terms and rules used across the Imploy API, webhooks and MCP.

The building blocks

Access tokens and permissions

An access token starts with imp_at_. Each token sets every permission area (Clients, Staff, Roster, Forms, Reports, Tasks, Incidents, Prospects, Finance) to Disabled, Read or Read-write. Clients, Roster and Staff must be set on every token. See Permissions.

Requests run as the organisation owner, limited to the token's permissions. Changes follow the same checks and notifications as the Imploy app, and appear in the activity log.

Conventions

  • Base URL: https://app.imploy.com.au/api/integrations/v1.
  • Lists return data and meta (page, per_page, total, last_page). per_page is 1 to 100, default 50.
  • updated_since returns only records updated on or after a date. Use it for syncing.
  • PATCH changes only the fields you send.
  • Bulk endpoints take up to 50 items. Many have a dry_run option to check first.
  • Imports return a batch id that you can use to undo the import.

Three ways to connect

NeedUse
Read or change data from your codeThe REST API
Be told when something changesWebhooks
Let an AI assistant read or change dataMCP

All three respect the same permission areas. Webhooks are set up separately from tokens; see Setting up.

For the sector terms (NDIS, SaH, HCP, SCHADS and so on), see the Glossary.