Connecting an integration
An integration reaches your EVX Software data through the API only after two things happen: EVX Software support issues its credentials, and an administrator at your firm grants it access as a specific user. This page covers both, and how to keep the connection secure.
The technical reference, with authentication, every endpoint, and code samples, is at developers.evxsoftware.com.
This version of the API is available from EVX Software version 4.3. Granting access requires an administrator of your installation.
Jump to:
- Request the credentials
- Create the user the integration acts as
- Grant access
- Keep the connection secure
- Revoke access
Request the credentials
Ask EVX Software support for an API client for your installation, and say which integration it is for. Support sends three items:
| Item | What it is |
|---|---|
| Client ID | The name that identifies this integration |
| Client secret | Its password. Treat it like any other password. |
| Token endpoint | The address the integration contacts to sign in |
Give these to the developer or IT team that builds the integration. Request one API client for each integration, so each one can be granted and revoked on its own.
Create the user the integration acts as
The integration does everything as one user of your installation. Create a user for it, named after the integration, rather than using a real person's account. See User management.
Give that user only the permissions the integration needs. For example, an integration that records time on field projects needs access to those projects and to time entries, and nothing else. See Permissions and access control.
Do not let an integration act as an administrator. Administrators bypass permission checks, so the integration would reach everything in your installation.
Grant access
AdministrationAPI access
- Find the client ID that support sent you.
- Choose the user the integration acts as.
- Save.
The integration can now sign in and work with the records that user can see. If it tries something the user is not allowed to do, EVX Software refuses the request.
Keep the connection secure
- Store the client secret in a secure place, such as a password manager or your server's secrets store. Never put it in an email, a document, or the integration's code.
- If the secret is exposed, ask EVX Software support for a new one. The old secret stops working.
- Review the user's permissions when the integration changes what it does.
Developers find the technical security guidance on developers.evxsoftware.com.
Revoke access
AdministrationAPI access
Revoke the integration's access. It stops working immediately, and its next request is refused. Revoke access when an integration is retired, when a vendor contract ends, or when you suspect the credentials were exposed.
What you can do next
- What the API covers for the records the integration can reach.
- developers.evxsoftware.com to hand the technical reference to your developer.
- Permissions and access control to fine-tune the integration user's access.