Integration API reference

For Magoven platform teams and enterprise integrators. All external APIs require the product bridge secret unless noted.

Environment variables

MAGOVEN_ONE_URL=https://one.magoven.io
MAGOVEN_PRODUCT_BRIDGE_SECRET=<shared-secret>
PAYFAST_MERCHANT_ID / PAYFAST_MERCHANT_KEY / PAYFAST_PASSPHRASE
ONE_PUBLIC_URL=https://one.magoven.io

GET/api/external/resolve-org

Resolve orgKey and orgId from a user email. Used by magMeet for org-scoped meetings.

Auth: Bearer MAGOVEN_PRODUCT_BRIDGE_SECRET

[email protected]

{ found, orgId, orgKey, packageId }

GET/api/external/org-entitlements

Read org policies, seat pool, storage quota, and package. Platforms enforce guest/recording rules from policies.

Auth: Bearer MAGOVEN_PRODUCT_BRIDGE_SECRET

?orgId=org_abc or [email protected]

{ found, orgId, orgKey, packageId, policies: { meetGuestRules, meetRecordingDefault, ... }, poolLicenses }

GET/api/external/activity

Append or list org activity events for the unified activity feed.

Auth: Bearer MAGOVEN_PRODUCT_BRIDGE_SECRET

GET ?orgId=…&limit=50 — POST body: { orgId, type, title, actorEmail, metadata }

{ events: [...] }

POST/api/external/meeting-summary

Post AI meeting summaries from magMeet into magWork CRM when workCrmAutoNotesFromMeetings policy is enabled.

Auth: Bearer MAGOVEN_PRODUCT_BRIDGE_SECRET

Body: { orgId, meetingId, meetingTitle, summary, hostEmail }

{ success, crmNoteId? }

GET/POST/PATCH/DELETE/api/scim/v2/Users

SCIM 2.0 user provisioning. Create, update, deactivate members and sync licenses.

Auth: Bearer SCIM token (configured in Settings → Enterprise)

Standard SCIM User resource

SCIM User JSON

GET/api/auth/bridge

Cross-app SSO refresh — mints a short-lived platform JWT (packageId + licenses) without re-prompting for password. Suite apps redirect here on 401 / login.

Auth: User session cookie (magoven_one_session)

?platform=mail|drive|docs|meet|work&next=/path — Accept: application/json returns { url }

302 to platform SSO URL, or JSON { url }

GET/api/go/[platform]

SSO launcher — redirects signed-in users to meet, work, mail, etc. with a short-lived JWT containing orgId, licenses, and policies.

Auth: User session cookie (magoven_one_session)

/api/go/meet, /api/go/work, …

302 redirect with sso/token query param

POST/api/billing/checkout

Start secure checkout for a package upgrade. Returns form fields or applies a demo package when the payment gateway is not configured.

Auth: Session + billing_admin or owner role

Body: { packageId: "pro"|"business", billingCycle?: "monthly"|"yearly" }

{ checkout: { action, ...fields } } or { demo: true }

POST/api/billing/payfast/notify

Payment notification webhook. Marks transaction paid and applies package to org.

Auth: Payment ITN signature (gateway passphrase)

Gateway form POST (m_payment_id, custom_str1=orgId, custom_str2=packageId)

SSO JWT payload (5 min TTL): email, orgId, orgRole, licenses[], orgKey, policies{} — signed with the same bridge secret, audience per platform (meet, workspace, magmail, …).

Security overview →