A read-only API
Admins create API keys in the admin panel and choose what each one can read:
- Recognitions, leaderboards and company values.
- People and teams.
- Analytics: the summary and inclusivity health.
- Rewards and redemption requests.
Each key is shown once, can expire, and can be revoked at any time. Every key created or revoked is recorded in the audit log. The API is read-only: an integration can’t give points on someone’s behalf.
Webhooks
Pointd Pal can post to your systems as things happen: a recognition given or redacted, a reward requested, approved or fulfilled, a nomination program changing stage or announcing its winners.
- Signed: every request carries a signature you can check with the endpoint’s secret, using the Standard Webhooks format.
- Retried: a failed delivery is retried for about a day. An endpoint that keeps failing is paused and admins are told.
- Logged: the admin panel lists the last 30 days of deliveries, and any of them can be sent again.
What never leaves
- Private recognition stays private. An integration sees that a private recognition happened, never its reason.
- People who opted out don’t appear at all.
- Redacted reasons stay redacted.
Business customers get the full API and webhook reference, including an OpenAPI description to generate a client from.
The API and webhooks are part of the Business plan. Email sales to talk about it.