API Reference

Geodocs Public API

REST API with Personal Access Token (PAT) authentication for GIS project automation.

API:https://api.geodocs.io

Geo-API:https://geo-api.geodocs.io

Authentication

All requests require a Personal Access Token (PAT) in the Authorization header. Create tokens in Geodocs > Settings > API Tokens.

Token format: gdx_<48 hex chars>

Request header: Authorization: Bearer gdx_...

Rate limit: 100 requests/minute per token

Each token has scopes that control which endpoints it can access.

# Authenticate with PAT

curl -H "Authorization: Bearer gdx_a1b2c3..." \

https://api.geodocs.io/api/public/v1/folders

Pagination

All list endpoints support pagination with these query parameters:

pagePage number (default: 1)

limitItems per page (default: 50, max: 100)

termSearch/filter term

Response envelope

{
  "content": [{ ... }],
  "total": 142,
  "page": 1,
  "size": 50,
  "pages": 3
}

Endpoints

Folders

Scope: READ_FOLDER

GET/api/public/v1/foldersList folders (paginated)

GET/api/public/v1/folders/:keyGet folder by key

Assignments

Scope: READ_ASSIGNMENT

GET/api/public/v1/assignmentsList assignments (paginated)

GET/api/public/v1/assignments/:keyGet assignment by key

Expenses

Scope: READ_EXPENSE

GET/api/public/v1/expensesList expenses (paginated)

GET/api/public/v1/expenses/:keyGet expense by key

Budgets

Scope: READ_BUDGET

GET/api/public/v1/budgetsList budgets (paginated)

GET/api/public/v1/budgets/:keyGet budget by key

Statuses

Scope: No scope required

GET/api/public/v1/statusesList all board statuses

Webhooks

Scope: MANAGE_WEBHOOK

POST/api/public/v1/webhooks/endpointsSubscribe to events

DELETE/api/public/v1/webhooks/endpoints/:keyUnsubscribe

Layers

geo-api

Scope: No scope required

GET/api/public/v1/layersList layers (optional folderId filter)

GET/api/public/v1/layers/:id/mvt/{z}/{x}/{y}MVT vector tile

Geometries

geo-api

Scope: No scope required

POST/api/public/v1/geometries/geojsonExport geometries as GeoJSON

Webhook Events

When subscribed, Geodocs sends HTTP POST requests to your endpoint with this payload:

Available event types

folder.createdfolder.updatedfolder.deletedfolder.archivedassignment.createdassignment.updatedassignment.deletedexpense.createdexpense.updatedexpense.deletedbudget.createdbudget.updatedbudget.deleted

Event payload

{
  "id": "delivery-uuid",
  "event": "folder.created",
  "workspaceKey": "workspace-uuid",
  "occurredAt": "2026-03-28T14:22:00Z",
  "data": { "id": "entity-uuid", ... }
}

Signature verification

Each delivery includes an X-Geodocs-Signature header. Verify it using HMAC-SHA256:

// Node.js

const crypto = require('crypto');

const expected = crypto

.createHmac('sha256', secret)

.update(rawBody)

.digest('hex');

const received = header

.replace('sha256=', '');

const valid = crypto

.timingSafeEqual(

Buffer.from(expected),

Buffer.from(received));

Error Handling

All endpoints return standard HTTP status codes:

200OK

204No Content (DELETE)

400Bad Request

401Unauthorized

403Forbidden (missing scope)

404Not Found

429Too Many Requests

500Internal Server Error

Error response format

{
  "statusCode": 403,
  "message": "Token missing required scope: READ_FOLDER",
  "error": "Forbidden"
}

Ready to integrate?

Create your free account and generate an API token to get started.

Get Started Free

← Back to Home