CDRisk API v1

Your data, on tap

Read your inspections, findings, equipment and training records straight into whatever you already use. Included on every plan — we don't charge extra for you to get at your own records.

Quick start

  1. 1

    Issue a key

    In the portal, go to Admin → API Keys, name the key after whatever will use it, and grant only the scopes that thing needs. The key is shown once and never again.

  2. 2

    Send it as a bearer token

    curl https://api.cdrisk.com/api/v1/me \
  -H "Authorization: Bearer cdr_live_a1b2c3d4e5f6_..."
  3. 3

    Check what you got

    {
  "key_name": "Warehouse dashboard",
  "organization": { "id": "…", "name": "Jacobson Construction" },
  "scopes": ["sites:read", "equipment:read", "equipment:write"]
}

Endpoints

Base URL https://api.cdrisk.com/api. Every list endpoint takes limit (max 200) and offset.

MethodPathScopeReturns
GET/v1/me—What this key is and what it can do
GET/v1/sitessites:readYour sites
GET/v1/inspectionsinspections:readInspections, filterable by site and status
GET/v1/inspections/:idinspections:readOne inspection with its findings
GET/v1/findingsfindings:readFindings, filterable by status and risk level
GET/v1/equipmentequipment:readEquipment with QR codes
POST/v1/equipmentequipment:writeCreate an equipment record
GET/v1/training-recordstraining:readTraining records with expiry dates
POST/v1/training-recordstraining:writeCreate a training record

How keys behave, stated up front

Scopes do not imply each other

A key with equipment:write cannot read equipment unless it also has equipment:read. Grant exactly what the integration needs and nothing more.

Keys are organization-wide, not per user

A key authenticates your organization. It cannot reach the admin portal, the client portal, or any endpoint outside /v1 — even if the person who created it is an admin.

We cannot recover a lost key

We store a hash, never the key. If it goes missing, revoke it and issue another. Anyone who has the string can use it, so treat it like a password.

120 requests per minute, per key

Counted per key rather than per IP, so your integration is never throttled by someone else behind the same network. Over the limit returns 429.

Errors

  • 401 unauthorized — missing, unknown, revoked, or expired key. We return the same message for all of them on purpose.
  • 403 insufficient_scope — valid key, wrong scope. The response names the scope you need.
  • 404 not_found — the record does not exist, or belongs to another organization.
  • 429 rate_limited — over 120 requests in a minute.

Need an endpoint that isn't here?

The v1 surface is deliberately small — we exposed what customers asked for rather than everything we could. Tell us what you are building and we will tell you honestly whether it is on the roadmap.

Talk to us See Pricing