DuckdayDevelopers

Changelog

Every change to the Duckday public API, newest first. Within a version all changes are additive — see Versioning & deprecation.

2026-09 — To-Do

Endpoints

  • GET /v1/todos — the company's to-dos, ordered by id ascending. Filters: status, assigned_to, list_id, important, due_from/due_to, updated_since.
  • GET /v1/todos/{id} — fetch a single to-do.
  • POST /v1/todos — create a to-do in one of the company's lists and assign it to one of its members, or offer it to a role (title, list_id, assigned_to and/or assignee_group_id, notes, priority, important, due_date, due_is_all_day).
  • PATCH /v1/todos/{id} — update a to-do; every field optional, only the ones provided are written (title, notes, status, priority, important, due_date, due_is_all_day, list_id, assigned_to, assignee_group_id). An explicit null clears notes or due_date.

The to-do resource exposes status (waiting / open / in_progress / done / cancelled), priority (low / normal / high / urgent), due date, its list, its assignee, the role it is offered to (assignee_group) and who claimed it (claimed_by), checklist steps, tag_ids and the originating source (e.g. a linked project or activity). Comments and attachments are not part of the public contract.

Scopes

  • todos:read, todos:write (To-Do module)

Events

  • todos.created / todos.updated / todos.deleted

2026-07 — Absences & Expenses (read-only)

Endpoints

  • GET /v1/absences + GET /v1/absences/{id} — the company's leave requests (day, type, hours, lifecycle status). Free-text notes, reasons and attachments are not exposed. Filters: employee_id, status, date_from/date_to, updated_since.
  • GET /v1/expenses + GET /v1/expenses/{id} — project expenses (employee, project, category, description, date, and amount as an exact decimal string in currency, e.g. "42.50"). Pricing internals, km/ per-diem detail and attachments are not exposed. Filters: employee_id, project_id, category, date_from/date_to, updated_since.

Scopes

  • absences:read, expenses:read (Projects)

Events

  • absences.created / absences.updated / absences.deleted
  • expenses.created / expenses.updated / expenses.deleted

2026-07 — Employees, Roles & user provisioning

Endpoints

  • GET /v1/employees + GET /v1/employees/{id} — the company's employees (HR profile: identifiers, contract, hire dates, job title, supervisor). Payroll (salary), bank data, HR documents and photos are never exposed. Name/email live on the linked user (user_id).
  • GET /v1/roles + GET /v1/roles/{id} — the company's roles and the permissions they grant.
  • POST /v1/users — provision a new user (assign to the company, optional roles, optional invite email).
  • POST /v1/users/{id}/deactivate + /activate — enable/disable a user's login (only for users exclusive to this company).

Scopes

  • employees:read, roles:read (Core)
  • users:write (Core)

Events

  • employees.created / employees.updated / employees.deleted

2026-07 — Company

Endpoints

  • GET /v1/company — the authenticated tenant's own company profile (identity data only). No list endpoint and no by-id lookup: an integration can only ever see its own company.

Scopes

  • company:read (Core module)

Events

  • company.updated

2026-07 — Webhooks

Signed event deliveries pushed to your HTTPS endpoint — no polling.

Platform

  • Webhook endpoints with per-event subscriptions, managed from company settings; HMAC-SHA256 signatures (X-Onwork-Signature), automatic retries with exponential backoff, auto-disable after repeated failures.
  • Event payloads are rendered through the same resource models as the REST API (data = the resource, same shape as the corresponding GET).

Events

  • users.created / users.updated / users.deleted
  • projects.created / projects.updated / projects.deleted
  • shifts.created / shifts.updated / shifts.deleted

See the Webhooks guide for the envelope, signature verification and retry semantics.

2026-07 — Projects & Shifts (read-only)

Endpoints

  • GET /v1/projects — list the company's projects (filters: status, kind, customer_id, updated_since; paginated).
  • GET /v1/projects/{id} — fetch a single project.
  • GET /v1/shifts — list work shifts (filters: employee_id, project_id, status, date_from/date_to, updated_since; paginated).
  • GET /v1/shifts/{id} — fetch a single shift.

Scopes

  • projects:read (Projects module)
  • shifts:read (Projects module)

Project resources expose registry data only — commercial details (offer/order numbers, CIG/CUP codes, managers, notes, pricing) are not part of the public contract. Shift resources expose structural data only — free-text content and billing internals stay private.

2026-07 — Initial release (v1)

The first public release of the Duckday API.

Platform

  • Tenant API keys (owk_...) with per-key scopes, optional expiration, instant revocation and a management UI in company settings.
  • Authentication via X-Api-Key or Authorization: Bearer.
  • Uniform error envelope (error.code / message / status / details).
  • Rate limiting with Retry-After and X-RateLimit-* headers.
  • Idempotent retries via the Idempotency-Key header (Bearer auth).
  • Interactive reference generated from the live OpenAPI specification.

Endpoints

  • GET /v1/users — list the company's users (filters: active, email, updated_since; paginated).
  • GET /v1/users/{id} — fetch a single user.

Scopes

  • users:read

Coming next

  • Employees, absences and shifts resources.
  • Outbound webhooks with HMAC-signed deliveries.