Developers

Build on the Integration API

Q: Does the API write, or only read?

Both. The Integration API under /integrations/v1 supports read and write scopes. A read-only token cannot write.

Q: How do scopes work?

Each route requires a matching scope. Existing tokens do not receive new scopes until you update them. Revoking a token takes effect immediately.

Scoped bearer tokens, REST reads and writes under /integrations/v1, and signed outbound webhooks.

Base URL https://api.newempactwork.com

API reference Webhook events →

Quickstart · authenticated GET

Create a token under Integrations in the product. Grant programs:read. Then:

curl -sS https://api.newempactwork.com/integrations/v1/programs \
  -H "Authorization: Bearer YOUR_TOKEN"

Example response

{
  "success": true,
  "data": [
    {
      "programId": "prg_01HXYZ...",
      "name": "2026 Innovation Challenge",
      "year": 2026,
      "lifecycleStatus": "underway"
    }
  ],
  "meta": {
    "hasMore": false
  }
}

Envelope shape matches the published OpenAPI. Field sets vary by resource — see the programs reference.

Auth, scopes, and idempotency

Send a scoped bearer token on every request:

Authorization: Bearer <64-char hex token>

Create and revoke tokens under Integrations in the product. Revoking takes effect immediately. Tokens are auditable per request.

Optional Idempotency-Key on POST, PATCH, and DELETE. Cached for 24 hours per business + token + key + request body hash — retries after a timeout return the original response instead of applying the change twice.

Scopes

Each route requires a matching scope. A read-only token cannot write.

Read: submissions:read, programs:read, tracks:read, rounds:read, reviews:read, feedback:read, supplements:read, audit:read, payments:read, assignments:read, reviewers:read, emails:read, applicants:read, files:read, schemas:read, rubrics:read, exports:read

Write: submissions:write, assignments:write, supplements:write, feedback:write, programs:write, tracks:write, rounds:write, reviewers:write, emails:write, exports:write

What the Integration API covers

Surface area to sync a CRM or AMS, or to let an AI tool operate a program — without a separate agent product.

Programs & structure

List and update programs, tracks, and rounds. Patch lifecycle, intake fields, and branding copy within the scopes you grant.

Submissions & decisions

Create and update submissions; submit, screen, advance, eliminate, reopen, or withdraw.

Review & assignments

Invite reviewers, auto or bulk assign, reassign, read reviews and rubrics, release feedback.

Payments & audit

Read payment status and pull the audit trail that makes agent and integration actions defensible.

Exports

Async JSON packages with applicants, reviewers, submissions, raw reviews, and completed COI attestations.

Full reference

Every path, parameter, and response schema is in the OpenAPI-generated reference.

Open reference →

Verify webhook signatures

Every delivery is a JSON POST. The header is X-Webhook-Signature: sha256=<hex> — an HMAC-SHA256 of the raw request body using your endpoint secret. Verify with a constant-time compare before trusting the payload.

Payload shape

{
  "eventType": "submission.submitted",
  "eventId": "…",
  "timestamp": "2026-03-20T12:00:00.000Z",
  "data": { }
}

Python

import hmac, hashlib

expected = "sha256=" + hmac.new(
    secret.encode(), raw_body, hashlib.sha256
).hexdigest()
assert hmac.compare_digest(
    header_value, expected
)

Failed deliveries (non-2xx or network errors) are retried. Make handlers idempotent using eventId.

Rate limits

Integration API rate limits
Limit	Value
Requests on `/integrations/v1`	300 per minute per token
Create export (`POST /exports`)	1 request per five minutes per token

Errors

Responses use a shared envelope. On failure, inspect error.code, error.message, and optional error.details.

{
  "success": false,
  "error": {
    "code": "string",
    "message": "string",
    "details": {}
  }
}

List endpoints may also return meta.lastEvaluatedKey and meta.hasMore for pagination. Route-level response schemas live in the API reference.

Event catalog

Grouped the way a program runs. Schema links open the published webhook events reference.

Intake

Applicant registered applicant.registered

Fires when an innovator self-registers on a public track URL.

Schema →
Submission started submission.draft_created

Fires when an applicant begins a submission and saves the first draft.

Schema →
Submission completed submission.submitted

Fires when an applicant submits a complete application.

Schema →
Submission withdrawn submission.withdrawn

Fires when a submission is withdrawn from consideration.

Schema →
Supplement received supplement.response.submitted

Fires when a requested supplement is submitted.

Schema →
Payment completed payment.succeeded

Fires when a required entry fee is paid or recorded as paid offline.

Schema →
Payment failed payment.failed

Fires when an application fee payment fails.

Schema →
Payment waived payment.waived

Fires when staff waives an application fee.

Schema →

Review

Review submitted review.submitted

Fires when a reviewer submits scores and comments.

Schema →
Feedback released feedback.released

Fires when staff releases feedback to an applicant.

Schema →

Decisions

Submission state changed submission.state_changed

Fires on any submission state transition (screen, advance, eliminate, withdraw, reopen). Dedicated events such as submission.withdrawn may also fire for the same change.

Schema →

Administration

Program lifecycle changed program.lifecycle_status_changed

Fires when a program lifecycle status changes (for example draft → configured, underway, completed, or archived).

Schema →

Full payload shapes: webhook events reference.

Or hand the whole thing to an agent

The same Integration API and audit log that sync a CRM can power an AI agent calling /integrations/v1 — ChatGPT, Claude, or a custom tool. Read-only credentials for an agent that summarizes. Scoped write credentials for an agent that acts. Every request is auditable under the token that made it.

What we promise about changes

Versioning

Breaking changes ship under a new path version. The /integrations/v1 contract you build against keeps working.
Notice

We give 90 days written notice before deprecating anything, sent to every account with an active token.
The reference cannot drift

The published API reference is generated from the public OpenAPI specification — the same contract the API serves. The documentation tracks the running surface.

Developer FAQ

Does the API write, or only read?

Both. /integrations/v1 supports read and write scopes. A read-only token cannot write. You grant only the scopes the integration needs when you create the token.

How do scopes work?

Each route requires a matching scope (for example programs:read or submissions:write). Existing tokens do not receive new scopes until you update them. Revoking a token takes effect immediately and does not disturb staff sign-in.

Can an AI agent operate a program?

Yes. The same Integration API and audit log. Scoped write credentials let an agent act; every request is auditable under the token that made it.

Stuck on a route? Email the person who built this.

Integration questions go to the same inbox as the product. Include the endpoint, the scope on your token, and the error.code if you have one.

Email contact@newempactwork.com

Not the one building this? Here is what it means for your program →