Public API, webhooks and a Postman collection

Quickstart

Base URL https://mydbfm.com/api · header X-API-Key · 600 requests / minute per key by default; configurable per key

curl -H "X-API-Key: $DINABINA_API_KEY" https://mydbfm.com/api/v1/work-orders?status=open

Billing → API Keys (Professional and Enterprise plans). Keys are shown once and stored hashed.

All public endpoints live under /api/v1. Breaking changes ship as /api/v2 with 12 months of overlap.

Webhooks

Events: work_order.createdwork_order.closedasset.createdpm.dueiot.alertstatutory.duewebhook.test

HMAC-SHA256 over `{timestamp}.{raw_body}` using your subscription secret; reject if |now - timestamp| > 300 s. Headers X-DinaBina-Signature, X-DinaBina-Timestamp. 3 attempts with exponential back-off (10 s, 60 s, 10 min); endpoint must return 2xx within 10 s.

import hmac, hashlib
expected = hmac.new(secret.encode(), f"{ts}.{raw_body}".encode(), hashlib.sha256).hexdigest()
assert hmac.compare_digest(expected, signature)

const expected = crypto.createHmac('sha256', secret).update(`${ts}.${rawBody}`).digest('hex');
if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) throw new Error('bad signature');