API Documentation

Getting Started

Overview

The Log My Business API allows third-party applications to access and manage organization data including customers, projects, tasks, time entries, and mileage records. All API endpoints are scoped to an organization and require proper authentication.

Base URL

https://app.logmybusiness.com/api

Organization ID

All API endpoints require your Organization ID in the path. You can find it in two places:

• The Developer Portal displays your Organization ID at the top of the page
• Authorization Code flow only: Call GET /api/organization/my-organizations with your access token to list all organizations the authenticated user belongs to

Quick Start

1. Go to the Developer Portal and register a new application
2. Choose Confidential for server-to-server access or Public for browser/mobile apps
3. Select the API scopes your application needs
4. Save your Client ID and Client Secret (shown only once)
5. Use the credentials to obtain an access token
6. Include the access token in the Authorization header of your API requests

Two Authentication Flows

Authentication

Client Credentials Flow

Exchange your client credentials for an access token. Requires a confidential client.

Request

POST /connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=client_credentials
&client_id=YOUR_CLIENT_ID
&client_secret=YOUR_CLIENT_SECRET
&scope=api:customers:read api:projects:read

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600
}

Authorization Code + PKCE Flow

For applications that need user-delegated access. Works with both public and confidential clients.

Step 1: Redirect user to authorize

GET /connect/authorize?
  client_id=YOUR_CLIENT_ID
  &response_type=code
  &redirect_uri=https://your-app.com/callback
  &scope=openid email profile api:customers:read
  &code_challenge=YOUR_PKCE_CHALLENGE
  &code_challenge_method=S256

The user will see a consent screen listing the requested permissions. After approving, they'll be redirected to your redirect_uri with an authorization code.

Step 2: Exchange code for token

POST /connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
&client_id=YOUR_CLIENT_ID
&code=AUTHORIZATION_CODE
&redirect_uri=https://your-app.com/callback
&code_verifier=YOUR_PKCE_VERIFIER

Response

{
  "access_token": "eyJhbGciOiJSUzI1NiIs...",
  "token_type": "Bearer",
  "expires_in": 3600,
  "refresh_token": "eyJhbGciOiJSUzI1NiIs...",
  "id_token": "eyJhbGciOiJSUzI1NiIs..."
}

Refreshing Tokens

POST /connect/token
Content-Type: application/x-www-form-urlencoded

grant_type=refresh_token
&client_id=YOUR_CLIENT_ID
&refresh_token=YOUR_REFRESH_TOKEN

Using Access Tokens

Include the access token in the Authorization header of every API request:

GET /api/customer/{organizationId}
Authorization: Bearer YOUR_ACCESS_TOKEN

Scopes

API Scopes

Scopes control what data your application can access. Request only the scopes you need.

Endpoints

All endpoints require authentication and are scoped to an organization via the {organizationId} path parameter. Abbreviated as {orgId} below.

Organization Members

Response

[
  {
    "userId": "abc-123",
    "email": "user@example.com",
    "displayName": "Jane Smith",
    "firstName": "Jane",
    "lastName": "Smith",
    "role": "Admin",
    "joinedAt": "2025-06-15T10:30:00Z"
  }
]

Customers

Create / Update Request Body

{
  "name": "Acme Corp",              // required
  "companyName": "Acme Corporation",
  "email": "contact@acme.com",
  "phoneNumber": "555-0100",
  "addressLine1": "123 Main St",
  "city": "Springfield",
  "stateProvince": "IL",
  "postalCode": "62704",
  "country": "US",
  "customerType": "Business",
  "status": "Active",
  "notes": "Key account",
  "creditLimit": 10000.00
}

Projects

Create / Update Request Body

{
  "name": "Website Redesign",       // required
  "customerId": 1,                   // optional, link to customer
  "description": "Full site overhaul",
  "status": "Active",
  "projectCode": "WEB-001",
  "hourlyRate": 150.00,
  "isBillable": true,
  "startDate": "2025-01-15",
  "endDate": "2025-06-30",
  "budgetAmount": 50000.00
}

Tasks

Create Request Body

{
  "title": "Design homepage mockup",  // required
  "projectId": 1,                      // required
  "description": "Create initial wireframes",
  "priority": 2,                        // 0=Low, 1=Medium, 2=High, 3=Critical
  "dueDate": "2025-02-28",
  "startDate": "2025-02-01",
  "estimatedHours": 8.0,
  "assigneeIds": ["user-id-1", "user-id-2"],
  "tagIds": [1, 3]
}

Update Request Body (all fields optional)

{
  "title": "Updated title",
  "status": "InProgress",             // Todo, InProgress, Review, Done
  "priority": 3,                        // 0=Low, 1=Medium, 2=High, 3=Critical
  "progress": 50,
  "actualHours": 4.5
}

Comment Request Body (POST / PUT)

{
  "comment": "Looks good — ready for review"  // required, max 5000 chars
}

Comment Response

{
  "id": 42,
  "taskId": 5,
  "userId": "abc-123",
  "userName": "Jane Smith",
  "profilePictureUrl": null,
  "comment": "Looks good — ready for review",
  "createdAt": "2026-05-05T14:22:00Z",
  "updatedAt": null,
  "isSystemGenerated": false
}

Tags

Create / Update Request Body

{
  "name": "Urgent",                   // required
  "color": "#EF4444",                 // required, hex color
  "description": "High priority items"
}

Time Entries

Create / Update Request Body

{
  "projectId": 1,                      // required
  "date": "2025-02-15",               // required
  "hours": 4.5,                        // required, 0.01-24
  "categoryId": 2,                     // optional project category
  "taskId": 5,                         // optional link to task
  "description": "Frontend work",
  "startTime": "09:00:00",            // optional
  "endTime": "13:30:00"               // optional
}

Mileage

Create Request Body

{
  "projectId": 1,                      // required
  "date": "2025-02-15",               // required
  "totalMiles": 45.2,                 // required
  "startMiles": 12500.0,              // optional, odometer start
  "endMiles": 12545.2,                // optional, odometer end
  "mileageRate": 0.67,                // optional, override default
  "description": "Client site visit",
  "isBillable": true
}

Invoices & Estimates

Tax-rate management (/api/invoice/{orgId}/tax-rates) and CSV export (/api/invoice/{orgId}/export) follow the same read/write scope split.

Recurring invoice schedules

Expenses

Create Request Body

{
  "projectId": 1,                      // required
  "taskId": 42,                       // optional, link to a task
  "date": "2025-02-15",               // required
  "categoryId": 3,                    // required
  "description": "Parts for job",     // required
  "amount": 129.99,                   // required
  "merchant": "Hardware Depot",       // optional
  "isBillable": true
}

Products & Services Catalog

Webhooks (outbound)

Webhooks push event notifications to your server the moment something changes in Log My Business — tasks, customers, invoices, and estimates — so you don't have to poll. Register an HTTPS endpoint in the Developer Portal → Webhooks section, choose the events you care about, and we'll POST a signed JSON payload to it on every matching event.

Event Types

Delivery Format

Every delivery is an HTTP POST with a JSON body:

POST /your/endpoint HTTP/1.1
Content-Type: application/json
X-LMB-Event: task.moved
X-LMB-Delivery: 3f8a1c9e6b2d4f709a8b1c2d3e4f5a6b
X-LMB-Timestamp: 1727683200
X-LMB-Signature: sha256=deadbeef...

{
  "id": "3f8a1c9e6b2d4f709a8b1c2d3e4f5a6b",
  "type": "task.moved",
  "createdAt": "2026-09-30T08:00:00Z",
  "organizationId": 42,
  "data": {
    "organizationId": 42,
    "projectId": 7,
    "taskId": 1234
  }
}

The data object carries just the ids relevant to the event — taskId for task events, customerId for customer events, invoiceId / estimateId (plus customerId) for invoicing events — alongside organizationId.

Verifying Signatures

Each subscription has a signing secret (shown once when you create it, and again only if you rotate it). Verify every delivery before trusting it: compute HMAC-SHA256(secret, "{timestamp}.{rawBody}") — the timestamp from the X-LMB-Timestamp header, a literal dot, then the raw request body — and compare it to the hex digest in X-LMB-Signature.

// Node.js example
const crypto = require("crypto");

function verify(req, secret) {
  const ts = req.headers["x-lmb-timestamp"];
  const sig = req.headers["x-lmb-signature"]; // "sha256=<hex>"
  const expected = "sha256=" + crypto
    .createHmac("sha256", secret)
    .update(`${ts}.${req.rawBody}`)
    .digest("hex");
  return crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))
    && Math.abs(Date.now() / 1000 - ts) < 300; // reject stale deliveries
}

Retries and Auto-Disable

• Respond with any 2xx status within 10 seconds to acknowledge a delivery.
• Failed deliveries are retried twice (after roughly 5 and 30 seconds) — 3 attempts in total.
• After 10 consecutive failed events, the subscription is automatically disabled and the last failure reason is shown in the Developer Portal. Re-enabling it clears the strike count.

Errors

Error Handling

The API uses standard HTTP status codes to indicate success or failure.

Error Response Format

{
  "message": "A human-readable error description"
}

HTTP Status Codes