Casewelt operators
Our staff. They see every organisation, issue channel credentials, and handle the platform. Customers never sign in here.
Selling Casewelt
Provision Casewelt from the system your customer already uses.
A channel credential can create or find the organisations opened through that channel and link the customer’s external user identities. It cannot read their files or act as their organisation administrator.
Three doors, kept apart
Do not mix the keys.
Channel credential
Yours. You exchange it for a short-lived token and may only create or read the tenants you opened. You cannot open a customer’s files with it.
Organisation API user
The customer’s. Once the organisation exists, their own automation uses a separate client, scoped to that organisation alone.
What you send
Use your own reference and make retries safe.
Send a stable external_ref with the organisation name, plan and first administrator. The ensure endpoint creates the tenant once, then returns that same organisation when a response is lost and your system retries.
A conflicting slug or reference is reported instead of silently rebinding a customer.
POST /v1/oauth/platform-token
{ "grant_type": "client_credentials",
"client_id": "cwpp_…",
"client_secret": "cwps_…" }
POST /v1/platform/tenants/ensure
Authorization: Bearer …
{ "external_ref": "practice:tenant:7f3a9c2e",
"slug": "north-chambers",
"display_name": "North Chambers",
"plan_code": "business" }External identities
Link the same customer user without sending a second invitation.
Upsert a membership with the stable subject from your own identity system. A repeated call updates the same membership; it does not create another person.
This call links identity only. It does not issue a file token, open a workspace or give the channel credential access to customer content.
PUT /v1/platform/tenants/{organisation_id}/
members/by-external-subject/{provider}/{subject}
{ "email": "alice@example.com",
"display_name": "Alice Smith",
"status": "ACTIVE",
"role": "editor" }Clear boundary
Your product provisions. Casewelt governs the files.
Your product remains the place the customer does their craft. Casewelt remains the place the files are governed. The channel credential is the handshake between those two jobs. Secrets are shown once. Rotate them when someone leaves.
Organisation APIs (files, shares, signatures) are documented separately. Channel tokens are refused on those paths.
Work the contract
Bring the moment you would click “provision”.
We will walk create, host, first sign-in, and the error you should see if the plan is not allowed.