FinDash Docs · Reviewed 2026-08-09
FinDash Open API & Webhooks
Connect firm-owned systems to FinDash with scoped API keys, inbound and read endpoints, and signed outbound webhooks.
Use scoped firm API keys
Firm admins configure the Automation API in Firm Settings. Each key is bound to the organization and limited to selected scopes, such as reading contacts or accounts, creating tasks or notes, starting workflows, or managing webhooks. Treat the key as a secret and revoke or rotate it when an automation no longer needs access.
Connect your own systems
Any system that can send authenticated HTTP requests can use supported FinDash endpoints. Common uses include creating or updating contacts, opportunities, notes, and tasks; starting workflows; updating scheduler meeting links; and reading permitted firm, sharing, or AI Notetaker data.
Subscribe to signed webhooks
Outbound webhook subscriptions deliver selected organization events to your HTTPS endpoint. Verify the timestamped HMAC signature against the raw request body before processing an event, and make consumers idempotent because webhook deliveries can be retried.
Know the access boundary
The Open API is not anonymous or unrestricted access to every client record. Requests remain organization-scoped and require a key with the relevant permission. Use the MCP connector instead when ChatGPT, Claude, or another compatible AI client should act through an advisor's OAuth permissions.
Step by step
- Open Automation API: Go to Firm Settings → Automation API and review the available endpoints, scopes, and connector recipes.
- Create a narrowly scoped key: Select only the permissions required by the external system and copy the key when it is created.
- Test one bounded request: Use a non-production record, include an Idempotency-Key for supported writes, and verify the returned organization and target.
- Configure and verify webhooks: Subscribe only to needed events, verify signatures, and test delivery before relying on the automation.
Open this guide in FinDash Docs