API and integrations

For Zapier, Make, n8n and your own code. Base URL: https://api.cabinetproject.app/api/v1/public

Authentication

Create a token in the app under Settings > API Settings (company owner or a member with company edit permission). Pick only the permissions the integration needs. The token is shown once.

Authorization: Bearer YOUR_TOKEN

Connection test (works with any valid token):

curl -H "Authorization: Bearer YOUR_TOKEN" https://api.cabinetproject.app/api/v1/public/me
{"success":true,"data":{"company":{"id":"...","name":"Oak Kitchens"},"token":{"name":"Zapier","permissions":["projects.read"]}}}

Permissions:

Errors: 401 token_invalid / token_revoked, 403 insufficient_scope, 422 validation, 429 rate limit.

Rate limit: 60 requests per minute and 1,000 per hour per token. Past it the API answers 429 with error_code: rate_limit_exceeded, a Retry-After header and retry_after (seconds) in the body; wait that long and retry.

Resources

Lists return {"data":{"items":[...],"meta":{"current_page","last_page","per_page","total"}}}, newest first, per_page up to 100.

List filters

All lists accept page, per_page (default 25, up to 100), created_after, created_before and updated_after (ISO 8601). Each one also takes:

curl -X POST https://api.cabinetproject.app/api/v1/public/clients \
  -H "Authorization: Bearer YOUR_TOKEN" -H "Content-Type: application/json" \
  -d '{"name":"Pat Homeowner","email":"pat@example.com","phone":"+15555550100"}'

Polling triggers (Zapier "New ..." triggers)

Every list is newest first, so a polling trigger reads the first page and keeps the ids it has not seen. Use updated_after (ISO 8601) on any list to find records that changed after they were created, such as a project that moved stage.

REST hooks (instant triggers)

Needs the webhooks.manage permission. A hook is a regular webhook: signed, retried and listed under Settings > API Settings > Webhooks.

# subscribe (Zapier performSubscribe)
curl -X POST https://api.cabinetproject.app/api/v1/public/hooks \
  -H "Authorization: Bearer YOUR_TOKEN" -H "Content-Type: application/json" \
  -d '{"target_url":"https://hooks.zapier.com/hooks/standard/123/abc","event":"install.scheduled"}'
# -> 201 {"data":{"id":"HOOK_ID","event":"install.scheduled","target_url":"...","secret":"whsec_..."}}

# unsubscribe (performUnsubscribe)
curl -X DELETE https://api.cabinetproject.app/api/v1/public/hooks/HOOK_ID -H "Authorization: Bearer YOUR_TOKEN"

# sample for the trigger editor (performList): the latest real record, same shape as the delivery's "data"
curl "https://api.cabinetproject.app/api/v1/public/hooks/sample?event=install.scheduled" -H "Authorization: Bearer YOUR_TOKEN"

# list
curl https://api.cabinetproject.app/api/v1/public/hooks -H "Authorization: Bearer YOUR_TOKEN"

The target URL must be public HTTPS. Make: use a "Custom webhook" module URL as target_url, or create the webhook in the app.

Webhook deliveries

Each event is a POST with a JSON body:

{
  "id": "evt_01J...",            // same id on retries and replays: use it to deduplicate
  "event": "install.scheduled",
  "api_version": "v1",
  "created_at": "2026-10-01T14:03:11+00:00",
  "company_id": "...",
  "data": { ... },               // the record, see the events table
  "previous": { ... }            // only on change events: the old values
}

Headers: X-CabinetProject-Event, X-CabinetProject-Delivery and X-CabinetProject-Signature: t=TIMESTAMP,v1=HEX, where v1 is HMAC-SHA256 of TIMESTAMP + "." + raw body with the endpoint secret (whsec_...). Reject timestamps older than 5 minutes.

// PHP
[$t, $v1] = [null, null];
foreach (explode(',', $_SERVER['HTTP_X_CABINETPROJECT_SIGNATURE']) as $part) {
    [$k, $v] = explode('=', $part, 2);
    $k === 't' ? $t = $v : ($k === 'v1' ? $v1 = $v : null);
}
$body = file_get_contents('php://input');
$ok = abs(time() - (int) $t) <= 300
    && hash_equals(hash_hmac('sha256', $t.'.'.$body, $secret), $v1);

// Node
const [t, v1] = header.split(',').map(p => p.split('=')[1]);
const expected = crypto.createHmac('sha256', secret).update(`${t}.${rawBody}`).digest('hex');
const ok = Math.abs(Date.now() / 1000 - Number(t)) <= 300
  && crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));

Answer with any 2xx within 10 seconds. Anything else is retried 5 times (1 min, 5 min, 30 min, 2 h, 5 h); redirects are not followed. After 15 failed deliveries in a row the endpoint is disabled and the company owner is notified. Every delivery, with the response we got, is in the app's delivery log, where it can be replayed. The Test button sends event ping with the company's latest record of the endpoint's first event.

Events

Payload fields

A quote's lines are the boxes an integrator can order: SKU, quantity, hinge, room and name. The list (GET /quotes) and the quote.* webhook use that shape. Prices and labor without a SKU stay off it. GET /quotes/{id} also returns the stored line_items.

GET /invoices adds order_id, discount_amount, amount_paid and balance_due to the invoice fields, so an invoice.paid zap can post the payment to Xero or QuickBooks Desktop. GET /invoices/{id} also returns lines[{sku, name, qty, unit_price, amount}] (what the client is billed, never your cost) and payments in the payment shape.

previous: quote.* status changes and order.status_changed carry {"status": old}; order.purchase_status_changed carries {"order_status": old}; a moved install.scheduled carries {"scheduled_date", "scheduled_time"}; install.completed carries {"status": old}; project.stage_changed carries {"stage": old}; client.updated carries the changed fields' old values.

New leads from forms (inbound)

Any form, Zapier or Make can create a lead without a token: in the app, Settings > Lead sources gives a URL like https://api.cabinetproject.app/api/v1/lead-intake/SOURCE_TOKEN that takes a POST with any fields (name, email, phone, address, message); unknown field names can be mapped in the app.