Connect everything to Exolynk.
A documented, token-secured REST API for your records, files, queries and your own custom endpoints. Standards-based: OpenAPI 3.0.3, JSON over HTTPS.
Up and running in three steps.
Create a token, send your first request, and explore the full OpenAPI description.
1. Create a token
In the Exolynk UI open Profile > Security > API tokens and create a token. The secret (exo_pat_…) is shown only once — Exolynk stores just a hash.
2. Call the API
Send the token as a bearer token to /api on your Exolynk host — for example GET /api/model to list your environment’s models.
3. Explore
The OpenAPI document describes every operation and schema. Import it into Postman, Insomnia or any OpenAPI-based client generator.
See it in action.
Plain HTTP, JSON in and out. Replace the placeholders with your own host, token and identifiers.
curl -s https://<your-exolynk-host>/api/model \
-H "Authorization: Bearer exo_pat_XXXXXXXX"curl -s -X POST https://<your-exolynk-host>/api/record \
-H "Authorization: Bearer exo_pat_XXXXXXXX" \
-H "Content-Type: application/json" \
-d '{"model": "<model-uuid>"}'SELECT * FROM * LIMIT 10;
SELECT ident, name, created_at FROM invoice WHERE name like '%2026%';
SELECT sum_currency(price, "CHF") FROM car;Export any query as CSV, for example for BI tools and spreadsheets:
curl -s -G https://<your-exolynk-host>/api/service/sql/csv \
-H "Authorization: Bearer exo_pat_XXXXXXXX" \
--data-urlencode "query=SELECT ident, name FROM * LIMIT 100;"curl -s -X POST https://<your-exolynk-host>/api/file \
-H "Authorization: Bearer exo_pat_XXXXXXXX" \
-F "files=@contract.pdf;type=application/pdf"A custom endpoint is a script on the platform (Rune). This minimal one echoes a field from the request body:
pub async fn main(req, res) {
let body = req.body()?;
let payload = body.read_to_string().await?;
let json = json::from_string(payload)?;
let data = json["body"];
Ok(`received ident=${data["ident"]}`)
}Call it under your environment’s REST namespace:
curl -s -X POST https://<your-exolynk-host>/api/rest/<environment>/test_endpoint_post \
-H "Authorization: Bearer exo_pat_XXXXXXXX" \
-H "Content-Type: application/json" \
-d '{"body": {"ident": "hello"}}'The request payload arrives wrapped in a body key, and an endpoint returns a single value.
Everything your integrations need.
One consistent API surface for your data, your files and your own logic — with access rights enforced by the platform on every request.
Records
Create records, read their values, update single values, and follow the full change log with comments and relations.
Exolynk SQL
Query across models with an SQL-like dialect: filters, aggregations, LIMIT/OFFSET and full-text search. Get JSON or CSV back.
Files
Upload files and create file records, replace binaries, attach files to record variables, and download files or previews.
Custom endpoints
Write your own GET, POST, PUT, PATCH and DELETE endpoints as scripts on the platform and serve them under your environment’s REST namespace.
Webhooks
Notify your systems when data changes. Register webhooks for all records or only for the ones you care about.
Tokens and OAuth
Personal API tokens for REST calls, OAuth 2.0 with PKCE for interactive clients.
More API capabilities Fewer API capabilities
Model definitions
Read the model definitions of your environment: variables with their types and access rules, attached services and workflows, status and versioning. Models are read-only over REST.
Code resources
Create, read, update and delete endpoints, services and workflows programmatically, so you can version and deploy your integration logic with your normal tooling.
Services
Run server-side services through the API.
Secrets
Store credentials for your integrations inside the environment. The API lists secret names, never their values.
Environment and statistics
Read your environment’s settings, languages, workflows, services, endpoints and exchange rates, plus basic usage statistics.
Templates and translations
Manage templates (Typst definitions that render formatted PDFs) and translations, single entries or a whole set.
How it fits together.
External systems talk to one governed API surface. Exolynk enforces access rights on every request and notifies you back through webhooks.
graph LR;
A["ERP / CRM / Finance"] -->|"REST · Bearer token"| API["Exolynk REST API"];
B["BI & Reporting"] -->|"Exolynk SQL · CSV"| API;
C["Your apps & integrations"] -->|"Custom endpoints"| API;
API --> D[("Records · Files · Models
access rights enforced")];
D -.->|Webhooks| E["Your systems"];
What teams build with the API.
From master-data sync to audit views: typical integration patterns, built from the same few building blocks.
Sync master data with ERP and CRM
Read and update records, query with Exolynk SQL and react to changes with webhooks to keep your systems consistent.
Feed BI and reporting tools
Pull data as CSV or JSON straight from Exolynk SQL into your BI tool or spreadsheet.
Ingest external data
Publish a custom POST endpoint that receives orders, payments or other external data and creates records from it.
Automate document workflows
Upload files, attach them to record variables and use templates for formatted PDF output.
Power audit and compliance views
Read record logs, comments and relations to build traceability views for reviews and audits.
Trigger automated notifications
Combine webhooks with custom endpoints to alert people and systems when something changes.
Secure by design.
Authentication is standard, and access is enforced on the server for every request.
Personal API tokens
Created by users themselves, shown once, stored hashed, and sent as a standard bearer token.
OAuth 2.0 with PKCE
Authorization code flow with PKCE (S256), standard discovery documents, dynamic client registration and token revocation for interactive clients.
Server-side access control
Records are filtered by access rights and stations, and value visibility follows each model variable’s access settings.
Write-only secrets
Integration credentials stay inside your environment. The API lists secret names, never values.
The same environment also exposes an MCP endpoint for AI agents, protected by the same OAuth resource metadata. Explore MCP →
Developer resources.
Everything you need to build and test an integration.
OpenAPI description
An OpenAPI 3.0.3 description of every operation and schema, ready to import into Postman, Insomnia or any client generator.
REST API documentation
Endpoint reference, request and response formats, and authentication details in the developer documentation.
Open the REST docsScript API (Rune)
Write custom endpoints, services and workflows in Rune, the scripting language built into the platform.
Open the Script API docsREST API — Common Questions
Answers to the questions developers and integrators ask most about the Exolynk REST API.
Build your first integration
Read the developer documentation, then try the API in the sandbox against your own use case — from a first GET request to custom endpoints and webhooks.