Appz360 API Documentation | Developer Reference for Microsoft 365 Apps

Introduction

The Appz360 API lets you manage apps, users, and integrations programmatically across our AI-native suite for Microsoft 365 (CLMS360, Payroll360, Helpdesk360, and related products). The API is organized around REST, accepts JSON-encoded request bodies, returns JSON-encoded responses, and uses standard HTTP response codes.

All requests must be made over HTTPS. Requests over plain HTTP are rejected.

Quickstart

Create an API key. In the Appz360 admin console, open Settings → Developers → API Keys.
Get an access token. Exchange your client ID and secret for a short-lived bearer token (see Authentication).
Call the API. Send the token in the Authorization header, for example to list your installed apps:

curl https://api.appz360.com/v1/apps \ -H "Authorization: Bearer <access_token>"

Build for the products in your tenant: CLMS360 (contract lifecycle management), Helpdesk360 (ticketing) and Payroll360 (payroll).

Authentication

The API uses OAuth 2.0 client-credentials tokens scoped to your workspace. Generate an API key from Settings → Developers → API Keys in your Appz360 admin console, then exchange it for a short-lived bearer token.

Request an access token

curl https://api.appz360.com/v1/oauth/token \ -X POST \ -H "Content-Type: application/json" \ -d '{ "client_id": "YOUR_CLIENT_ID", "client_secret": "YOUR_CLIENT_SECRET", "grant_type": "client_credentials" }'

Include the returned token on every request:

Authorization: Bearer <access_token>

Making requests

Send requests to the base URL https://api.appz360.com/v1. Set Content-Type: application/json on requests with a body. List endpoints support limit and cursor query parameters for pagination.

Example request

curl https://api.appz360.com/v1/apps \ -H "Authorization: Bearer <access_token>"

Rate limits

Requests are limited to 120 requests per minute per API key. Each response includes rate-limit headers:

Header	Description
X-RateLimit-Limit	Maximum requests allowed in the current window
X-RateLimit-Remaining	Requests remaining in the current window
X-RateLimit-Reset	Unix timestamp when the window resets

Exceeding the limit returns a 429 Too Many Requests response.

Apps

Manage the Appz360 applications installed in your Microsoft 365 tenant.

GET/apps

List all apps installed for the authenticated workspace.

Response

{ "data": [ { "id": "app_clms360", "name": "CLMS360", "status": "active" }, { "id": "app_payroll360", "name": "Payroll360", "status": "active" } ], "next_cursor": null }

GET/apps/{app_id}

Retrieve details for a single app, including its enabled features and Microsoft Graph permission scopes.

PATCH/apps/{app_id}/settings

Update configuration for an app, such as enabled modules or notification preferences.

Request body

{ "notifications_enabled": true, "default_locale": "en-IN" }

Users

GET/users

List users provisioned in your workspace, synced from Microsoft 365 via Microsoft Graph.

POST/users/{user_id}/roles

Assign an app-level role to a user (for example, admin, approver, member).

DELETE/users/{user_id}

Deprovision a user from Appz360 apps. This does not remove the user from your Microsoft 365 tenant.

Webhooks

Subscribe to workspace events (app installs, user changes, workflow completions) by registering a webhook endpoint. Appz360 signs each payload with an X-Appz360-Signature header using your webhook signing secret.

POST/webhooks

Request body

{ "url": "https://example.com/webhooks/appz360", "events": ["app.installed", "user.deprovisioned"] }

Errors

Errors return a JSON body describing what went wrong, alongside a standard HTTP status code.

{ "error": { "code": "invalid_request", "message": "The 'app_id' field is required." } }

Status	Meaning
200/201	Success
400	Invalid request parameters
401	Missing or invalid access token
403	Token lacks required scope
404	Resource not found
429	Rate limit exceeded
500	Internal server error — retry with backoff

SDKs & libraries

Official client libraries are planned for Node.js and Python. Until then, the API can be called directly over HTTPS from any language using the examples on this page.

Changelog

Date	Change
2026-10-12	Documentation finalized: quickstart added, draft notice removed
2026-09-10	Initial public API reference published

Support

Questions about integrating with the Appz360 API can be sent to developers@appz360.com.