API: connect Zapier, Make and your own systems

Create a key

1. Open Company settings › Integrations › API. Only owners and admins see it.
2. Tap Create key, give it a name (for example, Zapier) and choose Read only or Read and write.
3. Copy the key right away and keep it somewhere safe: it's shown only once. gridOS keeps just its beginning (gk_live_a1b2…) so you can recognise it in the list.

If a key leaks or is no longer used, tap Revoke. Apps using it stop working right away. This can't be undone, but you can create another.

Address and authentication

Every call goes to:

https://pookurdrdvkpvnmwlwch.supabase.co/functions/v1/api/v1/

Send the key in the header Authorization: Bearer gk_live_…. Answers are JSON with camelCase fields (for example, dueDate and companyId). A list comes as {"data": [...], "next": ...}; one item as {"data": {...}}.

What you can do

Read (any key):

• GET clients · GET clients/{id}: clients
• GET projects · GET projects/{id}: projects (filters: companyId, status)
• GET tasks · GET tasks/{id}: tasks (filters: projectId, status = todo, doing or done, updatedSince)
• GET invoices · GET invoices/{id}: invoices (filters: status, companyId, projectId)
• GET proposals · GET proposals/{id}: proposals

Create and change (read and write key):

• POST clients: name, and optionally email, phone, contact. The client comes in as a prospect.
• POST projects: name and companyId (without a client it's an internal project).
• POST tasks: title, and optionally projectId, dueDate and assigneeEmail (the e-mail of someone in the studio).
• PATCH tasks/{id}: title, status (todo, doing or done) and dueDate (null clears it).

Dates look like 2026-10-25. Example, create a task:

curl -X POST https://pookurdrdvkpvnmwlwch.supabase.co/functions/v1/api/v1/tasks \
  -H "Authorization: Bearer gk_live_…" \
  -H "Content-Type: application/json" \
  -d '{"title": "Review logo", "dueDate": "2026-10-25", "assigneeEmail": "ana@estudio.com"}'

Pages, limits and errors

• Lists come newest first, 50 at a time (up to 100 with limit=100). When there are more, the answer has next: send it back as cursor=… for the next page. offset works too.
• Up to 120 calls a minute per key. Above that the answer is 429: wait a moment and try again.
• Up to 20 active keys per studio.
• Errors come as {"error": {"code": ..., "message": ...}}: 401 wrong or revoked key, 403 a read-only key trying to change something, 404 not found, 400 a field is wrong.

Zapier and Make

Use the two pieces together:

• To start when something happens in gridOS (proposal accepted, invoice paid, new client…), use webhooks in Integrations › Advanced. In Zapier, the trigger Webhooks by Zapier › Catch Hook; in Make, the module Webhooks › Custom webhook. Paste the address they give you into a new gridOS webhook.
• To do something in gridOS (create a client, a task…), use the API. In Zapier, the action Webhooks by Zapier › Custom Request; in Make, the module HTTP › Make a request. Use the address with the path (for example, …/api/v1/tasks), the method, the Authorization header and a JSON body.

Create one key per tool. That way, if you need to revoke one, the others keep working.