Grovia + Open API & Webhooks

Build your own connection, or let your developer do it: API keys with read/write scopes, cursor pagination, and webhooks signed with HMAC-SHA256 and retried for 24 hours.

What it does

  • API keys per company, each with only the access you tick (read leads, create leads, read clients, create clients, read invoices and payments).
  • Endpoints for leads (list, read, create, update), clients (list, read, create), invoices (list, read) and payments (list).
  • Webhooks for seven events, each signed so your server can prove it came from Grovia.
  • A delivery log with the response your server gave, and one-click resend.
  • An OpenAPI 3.1 file and a Postman collection to import.

How to set it up

  1. Open Settings → API & Webhooks in Grovia.
  2. Create an API key and copy it (it is shown once).
  3. Read the reference at groviaos.com/developers, or import the OpenAPI file into your tool.
  4. Add a webhook address and choose its events; use "Send test event" to try it.

Good to know

  • Invoices are read-only in v1.
  • 120 requests a minute per key.
  • Quotes, tasks, tickets and expenses are not in the API yet.
  • Webhook addresses must be public https addresses.

Frequently asked questions

Does Grovia have an API?

Yes — a REST API at groviaos.com/api/v1 with API keys and scopes, plus signed webhooks. The full reference is at groviaos.com/developers.

How do I verify a Grovia webhook?

Each request carries a Grovia-Signature header: t=<unix time>,v1=<hex HMAC-SHA256 of "<t>.<raw body>" using your signing secret>. Recompute it and compare; reject old timestamps.

Can one key see another company's data?

No. A key belongs to one company account and every request is limited to that account's data.