Developers

Endpoint

GET https://rolodex-api.fleetworks.dev/public/search?q=<query>&type=<all|users|groups>

Example Request

curl "https://rolodex-api.fleetworks.dev/public/search?q=engineering&type=users"

Example Response

{
  "users": [
    {
      "displayName": "Alice Engineer",
      "sAMAccountName": "aengineer",
      "title": "Senior Engineer",
      "businessCategory": "Engineering",
      "isServiceAccount": false,
      "objectGUID": "a1b2c3d4-...",
      "memberOf": [{"group_name": "eng-platform"}]
    }
  ],
  "groups": [],
  "query": "engineering",
  "count": 1
}

How to Get a Key

1. Sign in to the Rolodex dashboard
2. Navigate to Settings → API Keys
3. Create a new key for your service account (requires org:admin role)
4. Copy the token (it will only be shown once)

Example Authenticated Request

curl -H "Authorization: Bearer dg_..." \
  "https://rolodex-api.fleetworks.dev/api/me"

Supported Events

Verifying Webhook Signatures

Each delivery carries X-Rolodex-Signature, X-Rolodex-Timestamp, and X-Rolodex-Delivery (dedup id). The signature covers timestamp + "." + rawBody — reject stale timestamps to defend against replay:

import crypto from 'crypto'

function verifySignature(body, headers, secret, toleranceSec = 300) {
  const ts = headers['x-rolodex-timestamp']
  const sig = headers['x-rolodex-signature']
  if (!ts || !sig) return false
  // Replay defense: reject stale/future timestamps.
  if (Math.abs(Date.now() - Date.parse(ts)) / 1000 > toleranceSec) return false

  const expected = 'sha256=' +
    crypto.createHmac('sha256', secret)
      .update(`${ts}.${body}`, 'utf8')
      .digest('hex')
  const a = Buffer.from(expected), b = Buffer.from(sig)
  return a.length === b.length && crypto.timingSafeEqual(a, b)
}