Everything the console does, from your own code: integrations, flows, runs, connections, triggers, reconciliation, approvals and MCP. Version 2026-10-01.
The Nexra platform API lets your own software do what the Nexra console does: build and run integrations, follow every run, manage connections, triggers and reconciliations, receive signed events and answer approvals.
Authentication. Send a Nexra access token as Authorization: Bearer <token> and the workspace to act in as X-Workspace-Id: <workspaceId>. Sign in with the Nexra CLI (nexra auth login) to get a token; it carries your own role, so the API can do exactly what you can do in the console. Public operations need no token.
Errors. Every error has the same JSON shape: error, message, statusCode, requestId and path, plus a stable code where one exists. Quote the requestId (also sent as the X-Request-ID header) when you contact support.
Lists. List operations return the newest items first, as a plain array capped at a documented size. Operations that page with a cursor return { items, nextCursor }; pass nextCursor back as cursor until it is null.
Retries. Requests that start work (for example starting a run) take an idempotencyKey. Sending the same key again returns the first result instead of starting the work twice, so it is safe to retry after a network error.
Versioning. This description is version 2026-10-01. Adding an operation or an optional field is not a breaking change; a breaking change gets a new dated version.
The TypeScript and Python examples use the Nexra SDKs. Contact us at contact@usenexra.ai for package access. The cURL examples work today.
Errors
Error
{
"error": "request_failed",
"message": "A bounded execution idempotency key is required.",
"statusCode": 400,
"requestId": "1f0c2a4e-6b1d-4c39-9d0f-2f8a8e1f6b7a",
"path": "/api/console/connect/flows/cmflow01orders/executions"
}
400
The request was not valid. message says what to change.
401
The access token is missing, expired or revoked.
403
Your role in this workspace does not allow this action, or the workspace is not yours.
404
Nothing with that id exists in this workspace.
409
The request conflicts with the current state, for example a record that was already decided.
413
The request body is larger than this endpoint accepts.
429
Too many requests. Wait for the number of seconds in Retry-After, then try again.
500
Nexra could not complete the request. It is safe to retry with the same idempotency key.
503
The service this needs is switched off or busy for your workspace. message says which; try again later.
Integrations
An integration groups the flows that connect two or more systems for one business purpose.
GET/api/console/connect/integrations
List integrations
Integrations in the workspace, most recently changed first, with their flows and lifecycle. Archived and deleted ones are left out.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/connect/integrations"),
);
Response · 200
Success.
A list, newest first, capped as described above.
Response fields
Field
Type
Description
idrequired
string
projectIdrequired
string
namerequired
string
slugrequired
string
descriptionrequired
string | null
statusrequired
string
Stored status, for example draft, active or archived.
A description of the integration for use from other tools: its flows, operations, mappings and how to call it through MCP. It never contains credentials.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Copies a tested version to live and asks for approval where the workspace needs it. Answers 409 with a code when the version is not ready, for example sandbox_test_required.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
flowId (path)required
string
The flow id.
versionId (path)required
string
The version id.
Request body · application/json
Request body
Field
Type
Description
environmentId
string
runMode
"always_on" | "supervised"
How the flow runs once Live. Applied when the go-live is activated.
Test or Live, and once Live: always_on (runs unattended within the workspace's rules) or supervised (every Live write waits for a person's approval). Includes clean Live runs in a row and, for a Supervised flow, a suggestion to move to Always on (never applied automatically).
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Immediate: the Live copy stops and Live runs that have not started are cancelled; runs already working finish. Owners, admins and Connect operators. Recorded in the audit log.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
For a flow switched back to Test with no change since: the go-live checks run again, then the same approved Live copy is switched back on with the chosen run mode. Answers 409 go_live_required when the flow changed; request a new go-live instead.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Where the flow stands (test, live or live_with_changes: Live, with a tested change or a draft waiting), what the next go-live changes compared with the Live version (steps, field matching, rules, apps, schedule) in plain sentences, and who may take it live.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Uses a live connection the workspace already has for one app of the flow, instead of entering that app's live key again. Owners, admins and Connect operators. Recorded in the audit log. Answers with the go-live readiness.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Immediate: the earlier version, approved when it first went live, replaces the Live one; the replaced version is kept. The run mode stays as it is. Owners, admins and Connect operators. Recorded in the audit log.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Starts a run of the flow's published version. Retrying with the same idempotencyKey returns the first run (with replayed: true) instead of starting another.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
flowId (path)required
string
The flow id.
Request body · application/json
Request body
Field
Type
Description
environmentrequired
"sandbox" | "production"
sandbox is Test mode; production is live.
idempotencyKeyrequired
string
8 to 160 characters of letters, digits and . _ : -. Sending the same key again returns the first result instead of repeating the work.
correlationIdrequired
string
Your own reference for tracing this request across systems (8 to 160 characters).
triggerType
"manual" | "schedule" | "retry"
triggerReference
string
Your own reference for what started the run.
inputId
string
An uploaded input (POST /flows/{flowId}/inputs). Required for flows that read an uploaded file, refused otherwise.
endUserId
string
Run for one of your customers (an end user). Their own connections replace the app connections they connected through. Refused when they have not connected an app the flow needs.
externalUserId
string
Your own id for the end user, instead of endUserId.
For example queued, running, succeeded, partially_succeeded, failed or cancelled.
correlationIdrequired
string
idempotencyKeyrequired
string
startedAtrequired
string | null
ISO 8601 date and time.
completedAtrequired
string | null
ISO 8601 date and time.
durationMsrequired
integer | null
recordsReceivedrequired
integer
recordsProcessedrequired
integer
recordsSucceededrequired
integer
recordsFailedrequired
integer
recordsSkippedrequired
integer
retryCountrequired
integer
deadlineAtrequired
string | null
ISO 8601 date and time.
endUserId
string | null
The end user (your customer) this run acted for, when it was started for one.
createdAtrequired
string
ISO 8601 date and time.
updatedAtrequired
string
ISO 8601 date and time.
replayed
boolean
True when this answer is the run first started with the same idempotency key.
selfClearing
object | null
For runs with failed records: whether they still need a person, are being retried automatically, or were resolved automatically (by a retry or a later run).
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
flowId (query)
string
Only runs of this flow.
status (query)
string
Only runs with this status, for example failed.
endUserId (query)
string
Only runs for this end user.
pageSize (query)
integer
How many to return: 1 to 100, default 50.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/connect/executions"),
);
Response · 200
Success.
A list, newest first, capped as described above.
Response fields
Field
Type
Description
idrequired
string
integrationIdrequired
string
flowIdrequired
string
flowVersionIdrequired
string
triggerTyperequired
string
triggerReferencerequired
string | null
statusrequired
string
For example queued, running, succeeded, partially_succeeded, failed or cancelled.
correlationIdrequired
string
idempotencyKeyrequired
string
startedAtrequired
string | null
ISO 8601 date and time.
completedAtrequired
string | null
ISO 8601 date and time.
durationMsrequired
integer | null
recordsReceivedrequired
integer
recordsProcessedrequired
integer
recordsSucceededrequired
integer
recordsFailedrequired
integer
recordsSkippedrequired
integer
retryCountrequired
integer
deadlineAtrequired
string | null
ISO 8601 date and time.
endUserId
string | null
The end user (your customer) this run acted for, when it was started for one.
createdAtrequired
string
ISO 8601 date and time.
updatedAtrequired
string
ISO 8601 date and time.
replayed
boolean
True when this answer is the run first started with the same idempotency key.
selfClearing
object | null
For runs with failed records: whether they still need a person, are being retried automatically, or were resolved automatically (by a retry or a later run).
For example queued, running, succeeded, partially_succeeded, failed or cancelled.
correlationIdrequired
string
idempotencyKeyrequired
string
startedAtrequired
string | null
ISO 8601 date and time.
completedAtrequired
string | null
ISO 8601 date and time.
durationMsrequired
integer | null
recordsReceivedrequired
integer
recordsProcessedrequired
integer
recordsSucceededrequired
integer
recordsFailedrequired
integer
recordsSkippedrequired
integer
retryCountrequired
integer
deadlineAtrequired
string | null
ISO 8601 date and time.
endUserId
string | null
The end user (your customer) this run acted for, when it was started for one.
createdAtrequired
string
ISO 8601 date and time.
updatedAtrequired
string
ISO 8601 date and time.
replayed
boolean
True when this answer is the run first started with the same idempotency key.
selfClearing
object | null
For runs with failed records: whether they still need a person, are being retried automatically, or were resolved automatically (by a retry or a later run).
One record before → what Nexra did → after: each step in plain words, the rules that set values, and a field-by-field view. Sensitive values (email, phone, bank, card, ids, addresses, health data) are partly masked. Details are kept for 30 days unless your plan keeps them longer.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
For example queued, running, succeeded, partially_succeeded, failed or cancelled.
correlationIdrequired
string
idempotencyKeyrequired
string
startedAtrequired
string | null
ISO 8601 date and time.
completedAtrequired
string | null
ISO 8601 date and time.
durationMsrequired
integer | null
recordsReceivedrequired
integer
recordsProcessedrequired
integer
recordsSucceededrequired
integer
recordsFailedrequired
integer
recordsSkippedrequired
integer
retryCountrequired
integer
deadlineAtrequired
string | null
ISO 8601 date and time.
endUserId
string | null
The end user (your customer) this run acted for, when it was started for one.
createdAtrequired
string
ISO 8601 date and time.
updatedAtrequired
string
ISO 8601 date and time.
replayed
boolean
True when this answer is the run first started with the same idempotency key.
selfClearing
object | null
For runs with failed records: whether they still need a person, are being retried automatically, or were resolved automatically (by a retry or a later run).
Records a run could not deliver are held here so you can retry, ignore or resolve them.
GET/api/console/connect/dead-letter
List failed records
Records runs could not deliver, newest first. Up to 500.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
status (query)
string
open, retry_scheduled, retry_failed, auto_retry (being retried automatically), resolved or ignored.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/connect/dead-letter"),
);
Response · 200
Success.
A list, newest first, capped as described above.
Response fields
Field
Type
Description
idrequired
string
executionRecordIdrequired
string
flowIdrequired
string
statusrequired
string
open, retry_scheduled, retry_failed, auto_retry (Nexra is retrying it on its own after a temporary error), resolved or ignored. Only open and retry_failed need a person.
retryCountrequired
integer
createdAtrequired
string
ISO 8601 date and time.
lastRetryAtrequired
string | null
ISO 8601 date and time.
resolvedAtrequired
string | null
ISO 8601 date and time.
resolutionNoterequired
string | null
autoRetryState
string | null
Automatic retries: retrying, needs_person, supervised (the flow is Supervised), off or exhausted.
autoRetryAttempts
integer
autoRetryMaxAttempts
integer | null
autoRetryNextAt
string | null
ISO 8601 date and time.
resolutionKind
string | null
How it was resolved: auto_retry or later_run (resolved automatically), retry (a person's retry) or person.
open, retry_scheduled, retry_failed, auto_retry (Nexra is retrying it on its own after a temporary error), resolved or ignored. Only open and retry_failed need a person.
retryCountrequired
integer
createdAtrequired
string
ISO 8601 date and time.
lastRetryAtrequired
string | null
ISO 8601 date and time.
resolvedAtrequired
string | null
ISO 8601 date and time.
resolutionNoterequired
string | null
autoRetryState
string | null
Automatic retries: retrying, needs_person, supervised (the flow is Supervised), off or exhausted.
autoRetryAttempts
integer
autoRetryMaxAttempts
integer | null
autoRetryNextAt
string | null
ISO 8601 date and time.
resolutionKind
string | null
How it was resolved: auto_retry or later_run (resolved automatically), retry (a person's retry) or person.
open, retry_scheduled, retry_failed, auto_retry (Nexra is retrying it on its own after a temporary error), resolved or ignored. Only open and retry_failed need a person.
retryCountrequired
integer
createdAtrequired
string
ISO 8601 date and time.
lastRetryAtrequired
string | null
ISO 8601 date and time.
resolvedAtrequired
string | null
ISO 8601 date and time.
resolutionNoterequired
string | null
autoRetryState
string | null
Automatic retries: retrying, needs_person, supervised (the flow is Supervised), off or exhausted.
autoRetryAttempts
integer
autoRetryMaxAttempts
integer | null
autoRetryNextAt
string | null
ISO 8601 date and time.
resolutionKind
string | null
How it was resolved: auto_retry or later_run (resolved automatically), retry (a person's retry) or person.
open, retry_scheduled, retry_failed, auto_retry (Nexra is retrying it on its own after a temporary error), resolved or ignored. Only open and retry_failed need a person.
retryCountrequired
integer
createdAtrequired
string
ISO 8601 date and time.
lastRetryAtrequired
string | null
ISO 8601 date and time.
resolvedAtrequired
string | null
ISO 8601 date and time.
resolutionNoterequired
string | null
autoRetryState
string | null
Automatic retries: retrying, needs_person, supervised (the flow is Supervised), off or exhausted.
autoRetryAttempts
integer
autoRetryMaxAttempts
integer | null
autoRetryNextAt
string | null
ISO 8601 date and time.
resolutionKind
string | null
How it was resolved: auto_retry or later_run (resolved automatically), retry (a person's retry) or person.
Whether failed records with a temporary cause (the app was busy, slow or rate limited) are retried on their own, and how many times. Off until an owner or admin turns it on. Waits grow: 1 min, 5 min, 15 min, 1 h, then 6 h, with jitter and the app's Retry-After honoured.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/connect/self-clearing/settings"),
);
Owners and admins. Every automatic retry still follows the workspace's rules and approvals; Supervised flows and payments always wait for a person. Turning it off hands every waiting automatic retry back to a person.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Request body · application/json
Request body
Field
Type
Description
enabled
boolean
maxAttempts
integer
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.PUT("/api/console/connect/self-clearing/settings", {
body: {},
}),
);
Creates a connection from settings and a stored credential reference. Add the credential itself in the console. A live (production) connection needs a healthy Test mode connection of the same connector as sourceConnectionId.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Request body · application/json
Request body
Field
Type
Description
connectorKeyrequired
string
From the public connector catalogue.
projectIdrequired
string
namerequired
string
environment
"sandbox" | "production"
sandbox is Test mode; production is live.
slug
string
sourceConnectionId
string
configuration
object
Non-secret, connector-specific settings such as baseUrl or accountReference. Fields named like passwords, API keys, tokens, client secrets or credentials are refused.
Changing settings puts the connection back to draft until it is tested again.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
connectionId (path)required
string
The connection id.
Request body · application/json
Request body
Field
Type
Description
name
string
configuration
object
Non-secret, connector-specific settings such as baseUrl or accountReference. Fields named like passwords, API keys, tokens, client secrets or credentials are refused.
Your own customers (end users) and the accounts they connect through your app. Send a short-lived link, record what they agreed to, withdraw access, and answer access and erasure requests.
GET/api/console/connect/end-user-link-apps
List apps your customers can connect through
Your workspace connections that sign in with the provider's own page and have your app's client ID and secret saved. Customers connect through your own app; their sign-in runs under your app's keys.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/connect/end-user-link-apps"),
);
Adds a customer by your own id for them, or updates the name and email of one you already added. Scoped to the workspace, or to one project when projectId is given.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Request body · application/json
Request body
Field
Type
Description
externalUserIdrequired
string
projectId
string
displayName
string
email
string
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.POST("/api/console/connect/end-users", {
body: {
"externalUserId": "string"
},
}),
);
A short-lived, single-use, signed link to send your customer. connect opens a page that explains your purpose in plain words, records their agreement and then sends them to the app's own sign-in page; manage lets them see and withdraw what they connected. Links last 30 minutes unless you choose 5 to 120.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
endUserId (path)required
string
The end user id.
Request body · application/json
Request body
Field
Type
Description
kind
"connect" | "manage"
appConnectionId
string
Required for connect: from listEndUserLinkApps.
purpose
string
Required for connect: why you need the connection, shown to the customer word for word.
purposeKey
string
Your short label for this purpose.
account
object
Account details the app needs, if you know them (for example a store or subdomain name).
Deletes the stored access, turns the connection off and marks its consent revoked (the consent record is kept). Set onBehalfOfEndUser when your customer asked for it.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Records an erasure request. Nothing is erased until a workspace owner or admin approves it in the console; then stored access is deleted, personal data is cleared from run records and a minimal record of the erasure is kept.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Your workspace's own records that flows use: contract obligations and their reminders, the asset-to-customer map, evidence matrices for review, and statements made from a template. Each waits for a person where it should.
GET/api/console/connect/builtin-operations
List Nexra built-in operations
The operations a flow step of kind builtin can run on your workspace's own records, with their fields: obligations.create, obligations.list, obligations.update, obligations.complete, evidence_matrix.create, asset_customers.list, statements.generate and statements.get.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/connect/builtin-operations"),
);
Completes the current due date. A repeating obligation moves on to its next due date and stays open. A return or filing can't be completed here: a person marks it filed with proof (markObligationFiled).
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
The prepared file, the checks (calculated by Nexra, no AI), the approval and the proof of filing. Nexra prepares and reminds; a person files with the regulator.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Generate the file from figures (source: generated, xlsx or csv), use a statement (statementId) or a draft uploaded to /obligations/:obligationId/files (fileId). The checks are calculated straight away. A file waiting for approval or approved can't be replaced.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Opens a review task in the workspace approvals. Only the person who prepared the file sends it, and they can't approve it. Every check must pass first.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Records that a person filed the approved return with the regulator. Proof is required: the acknowledgement file (uploaded to /obligations/:obligationId/files), the filing reference, the date filed and who filed. For a repeating return the next period's obligation is created.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
obligationId (path)required
string
The obligation id.
Request body · application/json
Request body
Field
Type
Description
proofFileIdrequired
string
filingReferencerequired
string
filedOnrequired
string
YYYY-MM-DD, not in the future.
filedByUserId
string
filedByName
string
When the person who filed isn't a workspace member.
CSV text with asset and customer columns (optional: asset_name, crm_id, external_id). add keeps existing rows; replace first removes the customers of every asset in the file.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Rows by criteria, each cell evidenced (with a quote) or not evidenced, plus clarification questions. Opens a review task. Scores, ranks, outcomes and criteria about protected characteristics are refused.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Request body · application/json
Request body
Field
Type
Description
titlerequired
string
subject
string
What the rows are, for example candidates.
criteriarequired
array of object
rowsrequired
array of object
questions
array of object
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.POST("/api/console/connect/evidence-matrices", {
body: {
"title": "Site engineer applications, October",
"subject": "candidates",
"criteria": [
{
"key": "gas_safe",
"label": "Holds a current Gas Safe registration"
},
{
"key": "experience",
"label": "Three years of network maintenance experience"
}
],
"rows": [
{
"key": "candidate_a",
"label": "Candidate A",
"cells": {
"gas_safe": {
"status": "evidenced",
"quote": "Gas Safe registered since 2019",
"source": "CV, page 1"
},
"experience": {
"status": "not_evidenced"
}
}
}
],
"questions": [
{
"rowKey": "candidate_a",
"question": "How many years of network maintenance have you done?"
}
]
},
}),
);
Gives the flow a URL that starts a run when a signed request arrives. Without connectionId it is a signed trigger: by default Nexra makes a signing secret (nexra_v1) and returns it once. With connectionId and events it listens to that provider's events. Provider-issued signing secrets are added in the console.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
flowId (path)required
string
The flow id.
Request body · application/json
Request body
Field
Type
Description
name
string
environment
"sandbox" | "production"
sandbox is Test mode; production is live.
verification
string
How requests are verified. Default nexra_v1; provider schemes include shopify, stripe and github.
Send the raw file as the request body with Content-Type: text/csv or application/json. Then start a run with the returned inputId. Records that do not match the flow's input answer 422.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Public URL for senders. Sign the raw body: X-Nexra-Signature: v1=<hex HMAC-SHA256> over v1:<timestamp>:<eventId>:<raw body>, keyed with the trigger's secret. Each event id is used once; a repeat with the same body answers 200 with duplicate: true. Refusals answer { accepted: false, code }.
Signed with the trigger's secret
Send X-Nexra-Event-Id, X-Nexra-Timestamp and X-Nexra-Signature. No access token.
Parameters
Parameters
Field
Type
Description
publicId (path)required
string
The trigger's public id from its url.
X-Nexra-Event-Id (header)required
string
Unique per event: 8 to 128 of A-Z a-z 0-9 . _ : -.
For a side that is an upload, such as a bank statement. Send the CSV text as content in a JSON body. A contribution reconciliation takes sideschedule, payment, custodian or posting, and Excel files base64-encoded with formatxlsx; RSA PINs are kept only as a fingerprint and their last four characters.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Test mode only: loads synthetic files (three made-up employers over the last two months, with every kind of exception) into a contribution reconciliation.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Employer statements from contribution reconciliations, digital onboarding and benefit case packs with their timelines and sealed export, and the returns calendar. People decide every case and file every return.
Puts every open exception for one employer on a statement that waits for a second person's approval before anything sends it. Members appear by the last four characters of their RSA PIN.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Documents are sent as their file name, size and SHA-256 fingerprint; the files stay with you. The identity check is recorded as its outcome, never the NIN. The evidence goes to a second person for review.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
The evidence, each document's SHA-256, who opened, reviewed and decided the case with timestamps, and the IP address and device where captured, anchored to the governed evidence ledger and sealed with the SHA-256 of the body as canonical JSON.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Nexra for Professionals: read-only research from public registries (SEC EDGAR, Companies House, GDELT news, World Bank) and the person's own allowed tools. Plan, approve, follow progress, stop, and read a brief in which every number cites its source.
GET/api/console/research/runs
List research briefs
The signed-in person's research, newest first. Briefs are personal: other members don't see them.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Parameters
Parameters
Field
Type
Description
limit (query)
integer
1 to 50, default 20.
cursor (query)
string
The nextCursor from the previous page.
status (query)
string
Only this status, for example completed.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.GET("/api/console/research/runs"),
);
Response · 200
Success.
A page of items. Pass nextCursor back as cursor for the next page.
Turns a question into a plan: the subjects found in the registries, the exact reads it will make, and the steps it will use. Nothing is read from filings and no steps are used until the plan is approved. Read-only: research never writes to a connected tool. Answers 404 until research is switched on for the workspace.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Request body · application/json
Request body
Field
Type
Description
questionrequired
string
depth
"standard" | "deep"
standard (25 steps) or deep (100 steps). Default standard.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient(); // NEXRA_TOKEN and NEXRA_WORKSPACE_ID
const result = unwrap(
await nexra.POST("/api/console/research/runs", {
body: {
"question": "string"
},
}),
);
A run that hasn't started is cancelled at once and uses no steps. A running one stops before its next read and uses only the share of reads that happened.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
When a governed write's approval expired before anyone decided, this retries the flow record so a new approval opens and the approvers are told again. Answers 409 when the approval has not expired or nothing waits on it any more.
Access token and workspace
Send Authorization: Bearer <token> and X-Workspace-Id. The token acts with your own role.
Daily uptime for the last 90 days, measured by synthetic checks that run every minute outside the API. Only days with measurements are listed. No sign-in needed.
No sign-in needed
Anyone can call this operation.
Examples
javascript
import { createNexraClient, unwrap } from "@amakora/nexra-sdk";
const nexra = createNexraClient();
const result = unwrap(
await nexra.GET("/api/public/status/uptime"),
);
Ask questions about your business's own data, and read the Leadership summary, as the person who signed in. Read only, cited and logged. These need an OAuth access token that acts for a person in a read access group; workspace API keys and service credentials are refused.
POST/api/connect/v1/company/ask
Ask a question about company data
Asks one question across the systems the signed-in person's read access group can read, and returns a cited answer. Read only: nothing can be created, changed, sent or paid. Every number is cited to a read or a calculation Nexra did in code, and uncited numbers are removed. Personal details are hidden when the group says so. Use an OAuth access token that acts for a person who signed in themselves (the same token as /mcp, with company:read); workspace API keys and client-credentials tokens get 403. Each person can ask 10 questions in 10 minutes across the console, MCP and this API, and every question is in the read access log with origin api.
MCP access token
An OAuth access token for the MCP endpoint. MCP clients get one through the sign-in metadata.
Request body · application/json
Request body
Field
Type
Description
questionrequired
string
groupId
string
Which of your read access groups to ask under. Defaults to your first.
followUpOf
string
The id of your earlier answer this question follows up.
Examples
curl
curl -X POST "https://api.nexra.amakoragroup.com/api/connect/v1/company/ask" \
-H "Authorization: Bearer $MCP_ACCESS_TOKEN" \
-H "Content-Type: application/json" \
-d '{"question":"How much did we collect last week compared with the week before?"}'
Response · 200
Success.
Response fields
Field
Type
Description
idrequired
string
The read access log entry. Pass it as followUpOf to ask a follow-up.
questionrequired
string
originrequired
"api"
grouprequired
object
statusrequired
"answered" | "partial" | "refused" | "failed"
answerrequired
object
readsrequired
array of object
summaryrequired
string
textrequired
string
The answer as plain text with its citations, ready to show in a chat.
Today's Leadership summary for a member of a read access group with Insights on: headcount and who's in today by team (counts only), cash in and out yesterday and over 14 days, and money Nexra moved yesterday. The same OAuth rules as asking: a person's own sign-in only. Every view is logged with origin api.
MCP access token
An OAuth access token for the MCP endpoint. MCP clients get one through the sign-in metadata.
Examples
curl
curl -X GET "https://api.nexra.amakoragroup.com/api/connect/v1/company/leadership" \
-H "Authorization: Bearer $MCP_ACCESS_TOKEN"
The Model Context Protocol endpoint that exposes your published integrations as tools to AI agents.
POST/mcp
Send an MCP message
The MCP Streamable HTTP endpoint. Send one JSON-RPC 2.0 message per request: initialize, then tools/list and tools/call. Published integrations appear as tools. MCP clients discover sign-in from /.well-known/oauth-protected-resource/mcp.
MCP access token
An OAuth access token for the MCP endpoint. MCP clients get one through the sign-in metadata.
Parameters
Parameters
Field
Type
Description
Mcp-Session-Id (header)
string
The session id from the initialize answer. Required after initialising.
The Gateway's REST transport: the same published tools, scopes, rate limits and approval policies as the MCP endpoint, without an MCP session. Send the MCP OAuth access token as Authorization: Bearer <token>. The answer is the MCP tool result: content entries whose text is JSON.
Approvals. A sensitive tool or a governed write can answer { "status": "approval_required", "approval": { "id", "status", "expiresAt" }, "recoveryAction" } instead of running. Nothing has run yet. A different authorised workspace member approves it; then send the same request again, with the same arguments and idempotency key, and meta["nexra/approvalRequestId"] set to the approval id. Approvals expire, are bound to the exact request and are used once. Start a sensitive call with meta["nexra/idempotencyKey"] (and optionally meta["nexra/correlationId"]).
MCP access token
An OAuth access token for the MCP endpoint. MCP clients get one through the sign-in metadata.
Parameters
Parameters
Field
Type
Description
name (path)required
string
The published tool to call, for example search_capabilities, describe_capability or execute_capability.
Nexra for Professionals over MCP (Streamable HTTP, one JSON-RPC message per request, no session). Read-only desk_* research tools plus search and fetch. Its own OAuth resource and audience: tokens for /mcp are refused here and the other way round. Scopes: desk:research, and desk:work.read for the person's own tools (asked for on first use with a 403 insufficient_scope challenge).
MCP access token
An OAuth access token for the MCP endpoint. MCP clients get one through the sign-in metadata.
Nexra posts these to the endpoints you add under Event webhooks. Each request is signed: check X-Amakora-Signature with the SDK's constructEvent, answer with any 2xx within 8 seconds, and de-duplicate on the event id.
flow.run.succeeded
A flow run finished successfully
Every record in the run went through. Group: Flow runs.
Sent once a day at 07:00 UTC: runs, connections needing attention, waiting approvals and review items, usage and changes from the last 24 hours. Group: Workspace.