REST API

Klokk ships a read-only public REST API under /api/v1/* (/status, /users, /clock/states, /time/entries, /companies). Requests are authenticated with an API key and authorised per scope (e.g. read:users, read:time_entries), and rate-limited to 60 requests per minute per IP.

Super-admins manage integrations under API & Extensions (/admin/extensions). Each integration bundles an API key, its scopes, and one connection mode:

• API only — the extension calls the REST API above using its key.
• Webhooks — Klokk sends outbound HTTP POSTs on clock-in, clock-out, and leave events.
• WebSocket — the extension opens a persistent inbound connection at GET /api/v1/extension/connect.

Set EXTENSIONS_ENABLED=false to switch off the extension subsystem at the network level. The read-only REST API endpoints listed above remain available; only the webhook/WebSocket extension features below are disabled.

Variable	Default	Description
EXTENSIONS_ENABLED	true	Enable the extension API subsystem. When set to false: /admin/extensions and all sub-routes return 404 /api/v1/extension/connect WebSocket endpoint is not registered Outbound webhook dispatch is skipped entirely No ExtensionHub goroutines are started
WEBHOOK_ALLOW_PRIVATE_TARGETS	false	SSRF protection for outbound webhooks. By default, webhook URLs that resolve to loopback, private or link-local addresses are refused (including via redirects and DNS rebinding). Set to true only if you deliberately deliver webhooks to an endpoint on your internal network.