Developers

SafeHanded has a public REST API and outbound webhooks so you can create requests from your own tooling and react to their lifecycle. This is customer-facing API use — not SafeHanded’s internals.

Zero-knowledge still applies

The API creates and manages requests; it never handles plaintext credentials. Encryption and decryption happen in a browser, to and from a person’s key. There is no API that returns a decrypted secret — by design.

What you can do

• Create requests from your own systems and get back the link and challenge code to deliver.
• Read status — poll a request for its lifecycle state, or read the event feed.
• Drive close-to-purge — tell SafeHanded a ticket’s status from any platform.
• Receive webhooks on request lifecycle events (created, opened, submitted, revealed, completed, expired, revoked, reported) and a few organisation events, signed and retried.

Shares (“Send a secret”) are created in the app, because the secret is encrypted in the sender’s browser; the API can download a share’s certificate.

Authentication

Calls authenticate with an org- or client-scoped API key, created in Settings → API (Owners and Admins). The API is included on the Team plan and above. Scope a key to a single client where you only need to act for that client.

In this section

• API overview & authentication — base URL, keys, conventions and trying it in Postman.
• Webhooks — events, signatures and retries.
• API reference — every endpoint, with code samples and a built-in client to try calls.