Module Context

Total Access supports module-scoped webhooks and API keys. This allows you to restrict integrations to specific modules (e.g. Fleet, Finance, HR) for better security and organization.

Why module context?

• Security — Limit API keys to only the scopes needed for a specific module
• Organization — Group webhooks by module for easier management
• Filtering — Inbound webhooks scoped to a module only accept relevant data types
• Permissions — Module-level permission checks ensure users can only manage integrations for modules they have access to

Available modules

API keys with module context

When creating an API key, the scopes you select implicitly define the module context. For example, a key with only invoices:read and invoices:write scopes is effectively a Finance module key.

curl -X POST https://totalaccess.co.za/api/v1/integrations/api-keys \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Fleet Integration Key",
    "permissions": {
      "scopes": ["vehicles:read", "tracking:read", "tracking:write"]
    }
  }'

Inbound webhooks with module context

Inbound webhooks can be scoped to a specific module, which restricts the available webhook types:

curl -X POST https://totalaccess.co.za/api/v1/integrations/inbound-webhooks \
  -H "Authorization: Bearer YOUR_JWT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Fleet GPS Tracker",
    "webhook_type": "vehicle_location",
    "auth_method": "api_key",
    "module_context": "fleet"
  }'

Module-restricted webhook types

Outbound webhooks with module context

Outbound webhooks are naturally scoped by the events you subscribe to. Subscribing to job.created and job.completed effectively creates an Operations module webhook.

You can further restrict with filters:

{
  "events": ["work_item.created", "work_item.updated"],
  "filters": {
    "work_item_types": ["job", "task", "project"]
  }
}