InTouch Automation REST API
And this is the builder's door into it. Everything the UI does, the API does. No second-class surface, no hidden endpoints.
Jobs-as-code, full programmatic control, MCP-ready. The AI core sits at the center; the vault, scheduling, access control, and audit you script against all sit behind it. This is what InTouch AI exposes — not an older product with an API stapled on.
Micronaut Framework | OpenAPI 3.0 | Swagger UI | 511 Endpoints across 37 Domains
Built on the Micronaut framework with compile-time dependency injection, the InTouch REST API follows the OpenAPI 3.0 specification with integrated Swagger documentation. 511 endpoints across 37 functional domains give you complete programmatic control over jobs, scheduling, triggers, credentials, AI gateway, the tool plugin system, skills, IML jobs, and server administration. Nothing is gated behind a console. If the platform can do it, you can script it. InTouch AI can do everything a specialized older tool does.
Technology Stack
Micronaut 4.x
Compile-time DI eliminates reflection overhead. Fast startup, low memory footprint, non-blocking I/O.
OpenAPI 3.0
Standards-based specification enables automatic client generation in Java, Python, JS, C#, and more.
RESTful Design
Standard HTTP methods, stateless architecture, predictable URI patterns, JSON payloads.
JSON Format
All request and response bodies use JSON for maximum interoperability across platforms.
API Design Principles
Comprehensive Coverage
Every UI feature accessible via API
Consistent Patterns
Uniform CRUD operations across all domains
Idempotent Operations
GET, PUT, DELETE are safely repeatable
Clear Versioning
API versioning for backward compatibility
Descriptive Errors
Meaningful error codes and messages
Pagination Support
Efficient handling of large result sets
Integrated Swagger UI
No external docs portal. No stale PDF. Every endpoint is live, in your browser, against your own server. The integrated Swagger UI gives you live API testing, schema validation, code generation for multiple languages, and authentication integration. Access at http://[server]:[port]/swagger-ui.
API Functional Domains
Complete coverage from the live OpenAPI spec — 511 endpoints organized across 37 functional tag groups. Counts below match what is actually implemented in the running server.
| Domain | Endpoints | Description |
|---|---|---|
| Workflow | 53 | Full CRUD on workflows plus run, copy, content/schedule/trigger management, collision rules, exclusivity, and tool editing. The largest surface in the API. |
| Configuration | 41 | Server-wide settings: SMTP, SMS, messaging platforms (Slack, Discord, Telegram, WhatsApp, Teams, LINE), LDAP, CyberArk, AI assistant, encryption, runtime polling, sender filters. |
| Server | 31 | Edition info, license, autostart, log purge, maintenance mode, shutdown, restart, health and version endpoints. |
| AI | 30 | AI gateway routing (Enterprise-only: cost-optimized / latency-optimized / failover / round-robin / policy strategies across providers), prompt CRUD with named-resolve, usage summary by model / provider / project, usage purge. |
| InTouch AI Tool | 26 | IToolConnector plugins and IML tools: list, install, reload (single + all), scan, source export, hot-deploy. |
| Credential | 25 | Encrypted credential vault: connections to databases, cloud services, SSH/SFTP, AI providers, message channels, webhooks, OAuth, runtime environments. Full CRUD plus test/validate. |
| Monitor | 23 | Condition-driven Monitors (schedule + check + when arms) — CRUD plus enable/disable, validate IML, run-now, install-from-hub, copy, move. |
| IML Workflow | 22 | Workflows-as-Code (IML) lifecycle: load, validate, sync to DB, list, install, export, reload, dry-run, schedule wiring. |
| Schedule | 22 | Seven native schedule types (Day, Week, Weekday, Weekend, Month/Specific, Month/Relative, Custom) with timezone, blackout dates, expiration, and group management. |
| Skill | 19 | InTouch AI skills (SKILL.md) and OpenClaw skills: list, get, install, update, delete, invoke, source export, Hub search. |
| Role | 19 | Access control roles, custom roles, role-to-user and role-to-group assignments, per-object rights. |
| Workflow Activity | 17 | Execution history, log messages by date range / last execution / single run, work-completed time series, run/workflow ID lookups. |
| Group | 14 | Object groups for credentials, schedules, trigger files, Monitors, runtime envs, contacts — plus default-group resolution. |
| Inbox Messages | 14 | Per-user inbox: list-mine / list-mine-unread / list-by-user-id, get-by-id, get-unread-count, get-attachment, mark-read / mark-unread / mark-all-read, delete, delete-batch, delete-older-than-days, delete-before, export-csv. |
| Trigger File | 13 | Filesystem watch triggers with settle time, glob filters, group assignment, enable/disable. |
| Alert | 11 | Multi-channel alert subscriptions for job state transitions (start, done, error, retry, overrun, warning). |
| Assistant | 10 | AI assistant chat session, tool-use loop, command translation, prompt patterns. |
| Contact | 10 | Notification recipients (email, SMS, Slack, Discord, Telegram, WhatsApp, Teams, LINE) and group membership. |
| Operation Library | 10 | Reusable operation definitions shared across workflows — CRUD, listing, and library management. |
| Inbound Messaging Webhooks | 10 | Inbound webhook receivers for Slack, Discord, Telegram, WhatsApp, Teams, LINE and SMS — the return path for two-way messaging. |
| Track | 9 | Group workflows into executable sets within an area; CRUD plus list-by-area. |
| Area | 9 | Top-level resource container; create, copy, list, delete with optional cascade. |
| Oneshot | 8 | One-time tool execution outside the job framework — for AI assistant tool calls and script-driven actions. |
| Access | 8 | Login, logout, change password, generate / revoke API key, ownership transfer. |
| Runtime Environment | 7 | Python, Node, Bash, PowerShell, Ruby, Perl runtimes — registration, env-var management, test execution. |
| Import/Export | 7 | Configuration migration between environments — areas, workflows, schedules, credentials with selective export. |
| User | 7 | User account CRUD, group membership, locking. |
| Inbox Folders | 6 | User-defined folders for the in-app inbox: create, rename, move messages, delete. |
| Database Backup | 5 | Backup and restore of the embedded Derby database, on demand or on a schedule. |
| Capability Provisioning | 5 | Enterprise capability grants — which tools and objects a given user is provisioned for. |
| OIDC Provider | 5 | Sign in with InTouch — InTouch acting as an OIDC identity provider for Enterprise SSO. |
| Push Notifications | 4 | Device registration and delivery for mobile push. |
| Social Login | 4 | Sign in with Google, Microsoft or GitHub. |
| MCP | 3 | Model Context Protocol endpoints serving Claude Code and other MCP clients. |
| Bundle Exchange | 2 | Dependency-aware ZIP export/import of related objects as a single bundle. |
| Filesystem | 1 | Server-side filesystem listing for path pickers in the UI. |
| Channel | 1 | Messaging channel resolution shared across the outbound notification types. |
| Total | 511 | 37 functional domains |
Authentication
Session-based authentication via POST /intouch/access/login. The body is a LoginDTO with user + password (and an optional server override; default is intouch):
Content-Type: application/json
{
"user": "intouch",
"password": "your-password"
}
Response: { "sessionId": 1, "sessionToken": "1:4829371650284719", ... }
All subsequent API calls include the sessionToken (or sessionId) as a query parameter for authorization. API keys are an alternative — generate via POST /intouch/access/generate-api-key and revoke via /revoke-api-key.
Authorization Model
Multi-Tier Permissions
Read, create, update, delete, execute, and admin permission levels per resource.
Object-Level Security
Fine-grained access control on individual jobs, connections, and resources.
Group-Based Management
Assign permissions to groups, users inherit from group membership.
Session Controls
Configurable session timeouts, concurrent session limits, and audit logging.
HTTP Methods
| Method | Usage | Idempotent |
|---|---|---|
| GET | Retrieve resources | Yes |
| POST | Create resources, execute actions | No |
| PUT | Update existing resources | Yes |
| DELETE | Remove resources | Yes |
Response Codes
| Code | Meaning |
|---|---|
| 200 | Success — resource returned or action completed |
| 204 | Success — no content returned (delete operations) |
| 207 | Multi-status — partial success in batch operations |
| 400 | Bad request — invalid parameters or payload |
| 401 | Unauthorized — invalid or expired session |
| 403 | Forbidden — insufficient permissions |
| 404 | Not found — resource does not exist |
| 409 | Conflict — resource already exists or state conflict |
| 500 | Internal server error |
Integration Examples
Job Execution Workflow
Real endpoints from the live OpenAPI spec. Resource paths are kebab-cased; most lookups have by-id and by-name variants.
POST /intouch/access/login
# body: { "user": "intouch", "password": "..." }
# Step 2: Resolve job by fully-qualified name
GET /intouch/job/get-by-name?sessionId=$T&fqnJob=Default/Default/DailyETL
# Step 3: Run the job (returns 204 on success)
POST /intouch/job/run-job-by-names?sessionId=$T&fqnJobNames=Default/Default/DailyETL
# Step 4: List recent activity for the job
GET /intouch/job-activity/get-job-work-completed-from-days-ago?sessionId=$T&jobId=42&daysAgo=1
# Step 5: Pull log messages for the latest run
GET /intouch/job-activity/get-job-log-messages-for-last-execution?sessionId=$T&jobId=42
OneShot Ad-Hoc Execution
OneShot is the synchronous run-and-wait surface for ad-hoc job and task execution from REST clients, the AI assistant, or scripts. Returns a runId immediately, then poll status:
POST /intouch/oneshot/run-job?sessionId=$T
Content-Type: application/json
{
"fqnJob": "Default/Default/DailyETL",
"parameters": { "asOfDate": "2026-04-30" }
}
# Response: { "runId": 91240, "status": "running" }
# Poll for completion
GET /intouch/oneshot/status?sessionId=$T&runId=91240
# Or run a single task without a job wrapper
POST /intouch/oneshot/run-task?sessionId=$T
Content-Type: application/json
{
"taskType": "sql",
"credentialName": "warehouse",
"json": { "command": "SELECT count(*) FROM orders" }
}
Install a YAML Tool from Source
Don't start from a blank page. Find a ready-to-run tool, skill, job, or monitor on the InTouch Hub, install it, point it at your setup, and run. The same install path works from the API — hot-deployed, no server restart.
Content-Type: application/json
{
"name": "disk-space-check",
"yamlContent": "name: disk-space-check\\ninputs: ...",
"reload": true
}
# Hot-reload a single tool without server restart
POST /intouch/intouch-tool/reload/disk-space-check?sessionId=$T
Install a Skill from a SKILL.md
Content-Type: application/json
{
"name": "weekly-summary",
"markdown": "---\\nname: weekly-summary\\n---\\n..."
}
# Then invoke from any messaging channel: @weekly-summary
Performance
Micronaut Advantages
Compile-time dependency injection eliminates reflection overhead. Sub-second startup, minimal memory footprint, reactive non-blocking I/O.
Optimization Recommendations
Use batch operations for bulk changes, implement connection pooling, cache session IDs, use pagination for large result sets, prefer specific queries over broad searches.
Getting Started
API Access Points
API Base URL: http://[server]:[port]/intouch/
Swagger UI: http://[server]:[port]/swagger-ui
Quick Start Checklist
Setup
- Obtain InTouch AI server URL and port
- Get user credentials from admin
- Open Swagger UI to explore endpoints
- Test authentication with POST /access/login
Develop
- Download OpenAPI spec for code generation
- Import Postman collections for testing
- Implement authentication flow
- Build integration with your target platform
Development Tools
Postman
Pre-built collections for all API domains
Swagger Codegen
Auto-generate client libraries
curl
Command-line API testing
OpenAPI Generator
Enterprise client SDK generation
Best Practices
Security
- Use HTTPS in production
- Implement session timeout handling
- Follow least-privilege principle
- Rotate credentials regularly
- Log all API access for audit
- Validate all input parameters
Error Handling
At the API boundary you handle HTTP codes. Inside a job, the contract goes further: InTouch AI reads the failure, knows why, smart-retries, refreshes an expired token, and surfaces the one sentence that matters. "It broke. Here's why. I fixed it." No older tool can say that.
- Check HTTP status codes on every response
- Handle 401 with automatic re-authentication
- Implement exponential backoff for retries
- Log error responses for debugging
- Handle 207 multi-status for batch ops
Performance
- Reuse sessions across requests
- Use batch operations for bulk changes
- Implement pagination for large datasets
- Cache frequently accessed resources
- Use specific queries over broad searches
Support Resources
Swagger UI
Interactive API documentation and testing
OpenAPI Spec
Download the full specification for code generation
Technical Support
Documentation
Start Building with the InTouch AI API
Two doors into one platform: plain-English find-and-run for anyone, and this — workflows as code, MCP, full programmatic control for builders and DevOps. Standard REST. OpenAPI 3.0. Swagger UI. No proprietary SDK to learn, no surprises. Authenticate and go.
Contact Technical Support View Business Overview