Developer Tools

Tendrex includes a Developer tab for admins to integrate with external systems using the public REST API, webhooks, and an in-app API playground.

API keys

API keys provide programmatic access to the Tendrex public API (/api/v1). Each key has scoped permissions and an optional expiration date.

Creating an API key

1. Navigate to the Developer tab (admin access required).
2. Click Create API Key.
3. Enter a name for the key (e.g. “CRM Integration”, “Reporting Dashboard”).
4. Select the scopes:
   • Read — list and retrieve tenders, answers, documents, users, teams, and knowledge library entries.
   • Write — create and update tenders, answers, and documents. Includes read access.
   • Admin — full access including user management and API key management. Includes write and read access.
5. Optionally set an expiration date.
6. Click Create. Copy the key immediately — it will not be shown again.

Caution

Store API keys securely. They grant access to your organisation’s data according to their scopes. If a key is compromised, delete it immediately from the Developer tab.

Managing keys

From the Developer tab you can:

• View all active keys with their scopes, creation date, and usage count.
• Delete keys that are no longer needed.
• Monitor usage to identify inactive or over-used keys.

Webhooks

Webhooks notify external systems when events occur in Tendrex. Configure a URL and Tendrex will send a POST request with event data whenever a matching event fires.

Supported events

Category	Events
Tender	tender.created, tender.updated, tender.status_changed, tender.submitted, tender.outcome, tender.deleted
Answer	answer.approved, answer.rejected, answer.assigned
Compliance	compliance.updated
User	user.invited, user.joined
Document	document.uploaded, document.deleted

You can also use wildcards: * subscribes to all events, and tender.* subscribes to all tender events.

Creating a webhook

1. Go to the Developer tab and select Webhooks.
2. Click Create Webhook.
3. Enter the target URL (must be HTTPS).
4. Select the events you want to subscribe to (or use * for all events).
5. Tendrex generates a signing secret — use this to verify that incoming requests are genuinely from Tendrex.
6. Click Save.

Verifying webhook signatures

Every webhook delivery includes an X-Tendrex-Signature header containing an HMAC-SHA256 signature of the request body, signed with your webhook’s secret. Verify this to ensure the request is genuinely from Tendrex.

X-Tendrex-Signature: sha256=<hex-digest>
X-Tendrex-Event: tender.created

Payload format

{
  "event": "tender.created",
  "timestamp": "2026-03-26T10:30:00Z",
  "webhook_id": "...",
  "org_id": "...",
  "data": { ... }
}

Testing webhooks

Click Test on any webhook to send a sample event to your endpoint. This lets you verify your integration is working before relying on live events.

Delivery tracking

Each webhook shows a delivery log with:

• Status — success or failure for each delivery attempt.
• Response code — the HTTP status returned by your endpoint.
• Duration — how long the delivery took.
• Payload — the full event data that was sent.

Tendrex retries failed deliveries up to 3 times (at 30 seconds, 5 minutes, and 30 minutes). Webhooks are automatically disabled after 50 consecutive failures.

Tip

If deliveries are failing, check that your endpoint returns a 2xx status code within 10 seconds. Tendrex logs the response for debugging.

API playground

The Developer tab includes an interactive Playground for testing API endpoints directly from the browser. Select an endpoint, provide parameters, and see the response — authenticated with your current session.

This is useful for exploring the API before building an integration.

Public API overview

The public API is available at /api/v1 and uses Bearer token authentication with API keys prefixed tx_. See the Public API Reference for full endpoint documentation.

curl -H "Authorization: Bearer tx_your-api-key" \
  https://app.tendrex.co.uk/api/v1/tenders

An OpenAPI 3.0 specification is available at /api/v1/openapi.json for generating client libraries.