# API and webhooks

> Cablefolio has a JSON API described by an OpenAPI reference, personal API tokens, and signed webhooks, so scripts and other systems can read and write the same record the team uses.

- Personal API tokens, read or read-and-write, with an expiry, revocable at any time
- An OpenAPI reference inside the app
- Webhooks signed with HMAC-SHA256, retried, and paused after repeated failures
- Imports from spreadsheets and Fing, Meraki, UniFi, WiFi Explorer, IT Glue, and Hudu exports

## An API for the same record

A personal API token lets a script read, or read and write, the documentation as its owner, without a password. Tokens are 256 random bits stored only as a hash, scoped, expiring, and revocable by their owner or a manager. They are refused on every route that signs in, manages accounts, or reveals a secret. The OpenAPI reference lives in the app, next to the tokens.

## Webhooks

Managers choose https addresses to receive events, such as security log entries. Each delivery is signed with HMAC-SHA256 under the webhook’s own secret, carries no secrets, times out after ten seconds, follows no redirects, is retried, and the webhook is turned off after twenty failures in a row.

## Bring your data in, and take it out

Import devices into a room from a spreadsheet or from Fing, Meraki, UniFi, WiFi Explorer, IT Glue, or Hudu exports; seed a property’s rooms, racks, cable runs, and links from a spreadsheet; and import tester results. Every import is previewed and mapped before it writes; the IT Glue and Hudu imports bring devices across today, not passwords, documents, or contacts. NetBox device-type files import as presets. A full-data export is available at any time. See [importing](https://cablefolio.com/help/importing/).

## Questions and answers

### Does Cablefolio have an API?

Yes. Cablefolio has a JSON API with an OpenAPI reference. Personal API tokens can be read-only or read-and-write, expire, and can be revoked; API tokens and webhooks are on the Pro and Business plans.

### Can I import from IT Glue or Hudu?

Yes, for devices. Cablefolio imports IT Glue configurations and Hudu assets as devices, as well as Fing, Meraki, UniFi, WiFi Explorer, and any spreadsheet, mapping the columns before anything is written. Passwords, documents, and contacts are not imported yet.

### How are Cablefolio webhooks secured?

Each delivery is signed with HMAC-SHA256 under the webhook’s own secret, goes only to an https address a manager chose, carries no secrets, and follows no redirects.

## How-to guides

- [Importing your data](https://cablefolio.com/help/importing/)
- [Accounts and security](https://cablefolio.com/help/accounts-and-security/)

## Related features

- [Credential vault and security](https://cablefolio.com/features/security/): Roles, per-client limits, MFA, an encrypted credential vault, and a full audit log.
- [Reports and handover](https://cablefolio.com/features/reports/): Customer sign-off on site, and branded HTML, PDF, and Word as-builts from the live record.
- [Client portal and sharing](https://cablefolio.com/features/client-portal-and-sharing/): A read-only customer portal, expiring share links, one-time secret links, and credential requests.