API Access and Webhook Configuration

API Overview

GuardianHub provides a REST API for integrating your security operations data with external systems — HR platforms, payroll software, client reporting tools, and custom dashboards. The API uses JSON payloads, Bearer token authentication, and standard HTTP methods. All endpoints are documented with request/response examples. API access is available on Enterprise plans.

Generating and Managing API Keys

From Settings > API Keys, click Generate New Key. Give your key a descriptive name — this helps you track which integration uses which key. You can set permissions per key: read-only for reporting integrations, read-write for systems that need to create or update data. Keys can be revoked at any time. GuardianHub logs all API activity so you can audit which keys accessed which endpoints and when.

Available Endpoints

The API exposes endpoints for sites, guards, shifts, attendance, incidents, OB entries, patrol completions, and reports. Each endpoint supports filtering, pagination, and date range queries. The full API reference is available at the API documentation portal linked from the API Keys page. Common use cases include syncing guard attendance data to payroll systems and pulling incident reports into client-facing dashboards.

• GET /v1/sites — List all sites with filters
• GET /v1/guards — List all guards with licence status
• GET /v1/shifts — Shift data with date range filtering
• GET /v1/attendance — Clock-in/out records
• GET /v1/incidents — Incident reports with severity filters
• POST /v1/webhooks — Register a webhook endpoint

Webhook Configuration

Webhooks allow GuardianHub to push real-time event notifications to your external systems. From Settings > API Keys > Webhooks, add your endpoint URL and select which event types you want to receive. Supported events include: guard.clocked_in, guard.clocked_out, incident.created, patrol.completed, sos.triggered, and checkin.missed. GuardianHub sends a signed payload to your endpoint — verify the signature to ensure authenticity.

Security and Rate Limiting

All API requests must include your API key in the Authorization header as a Bearer token. Requests are rate-limited to 1000 requests per minute per key. Exceeding the limit returns a 429 status code with a Retry-After header. GuardianHub supports IP allowlisting for additional security — restrict API access to your office or data centre IP ranges. All API traffic is encrypted over HTTPS.