Skip to main content

Integration Hub and API

The Integration Hub is part of the platform rather than an app. It is open to company administrators and to people with the integration administrator role, under Admin, Integrations.

It has three parts:

  • the public API, for developers who call Thoshika from other systems;
  • webhooks, which send business events to your endpoints;
  • flows, which move records in or out of Thoshika without code.

Public API​

Create a credential​

  1. Open Admin, Integrations, API keys and apps and create a client.
  2. Choose the kind:
    • an API key, a single secret sent as a bearer token or in the X-Api-Key header;
    • an OAuth app, a client ID and secret exchanged for a one-hour access token with the client-credentials grant.
  3. Choose the roles the client acts with, and optionally a role scope (for example one GSTIN) and a list of apps.
  4. Choose read-only or read-write access, a rate limit, an expiry date and, if you like, an IP allowlist.
  5. Copy the secret. It is shown only once.

A client can never hold company administrator or integration administrator roles, and an integration administrator can only grant roles they hold themselves. Calls made with a credential go through the same app access, roles, scopes and company isolation as a person signing in.

Limits and logging​

  • Each client has a requests-per-minute limit and a daily quota. Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; over the limit you get 429 with Retry-After.
  • Every call is logged with the client, method, path, status and latency, and kept for 90 days. See Call log.
  • To rotate a key, use Rotate. The old secret keeps working for a grace period (24 hours by default).

Reference​

The developer portal under Admin, Integrations has the API reference generated from OpenAPI 3, an authentication guide, the event catalogue and the changelog. The API is versioned in the path (/api/v1).

Webhooks​

  1. Open Webhooks and add an endpoint URL.
  2. Choose the event types to receive, or all of them, and optionally limit to one app.
  3. Copy the signing secret.
  4. Use Send test event to check your endpoint.

Every delivery is a JSON envelope with the event ID, type, version, time, company, subject and data. Verify the X-Thoshika-Signature header, which holds a timestamp and an HMAC-SHA256 signature of the timestamp and body, and reject requests more than five minutes old. Use the X-Thoshika-Delivery ID to ignore duplicates, because a delivery can be retried.

If your endpoint fails, Thoshika retries eight times over about a day and a half. After that the delivery moves to the dead-letter list, where you can replay it. An endpoint that fails 50 times in a row is paused and integration administrators are notified.

Flows​

A flow moves records between Thoshika and another system.

The connectors for Tally, Zoho Books, QuickBooks Online, Darwinbox, Keka, greytHR, Salesforce, HubSpot and Zoho CRM are in beta. They are built on each vendor's published API or file format and tested against recorded samples, not yet against live accounts, so check the first runs carefully. The generic REST and SFTP/CSV connectors are generally available. Thoshika is not certified by, partnered with or affiliated with these vendors.

  1. Open Connections and connect the other system: sign in with OAuth for Zoho Books, QuickBooks Online, Salesforce, HubSpot and Zoho CRM, or enter credentials for the others.
  2. Start a flow from a template, such as expense claims to Tally vouchers or payroll to a Tally journal, or from scratch.
  3. Choose the trigger: an event, a schedule (every few minutes or daily at a set time) or manual.
  4. Map fields. Use lookup tables for values that differ between systems, such as ledger names, GST tax codes, cost centres and pay components.
  5. Preview the flow with a real event or the template's sample, then switch it on.

Runs appear in the Runs monitor with their items. Failed runs retry with backoff; runs that keep failing move to the dead-letter tab, where you can fix the mapping and replay them.

Records coming into Thoshika go through the owning app's rules. For example, an employee from an HR system is hired through People, and a journal is posted through Books, with the usual checks.

Tally on your own network (beta)​

Tally usually runs on a computer in the office. Install the Thoshika Bridge agent on a computer that can reach Tally, and connect it with the token shown under Connections. The bridge polls the hub over HTTPS and passes vouchers to Tally locally, so no inbound port is opened. If the bridge goes offline, integration administrators are notified.

Not available yet​

Multi-step flows with branching, separate test and live environments, a connector SDK, a management API for API clients, and connectors for Busy, Marg, SAP Business One and Workday are on the roadmap.

Next steps​