---
id: KB-IN-001
url: https://app.codecontract.io/help/integrations/connecting-to-your-systems
idioma: en
categoria: integraciones
audiencia: desarrollador
actualizado: 2026-08-13
tambienEn: [es]
relacionados: [KB-SC-001, KB-TZ-001, KB-CR-002, KB-IN-015]
citadoPor: [KB-IN-002]
enLaApp: https://app.codecontract.io/settings/api-keys
---

# Connecting the platform to your systems

_API, webhooks and external storage: what to choose depending on what you automate._

**Responde a:** code contract api · integrate with my erp · webhooks to receive platform events · sync documents with sharepoint · create an api key

There are three ways to connect the platform to what you already run, and you pick by the direction you want data to flow. Confusing them is the usual reason an integration ends up polling every five minutes for something that could have been pushed to it.

**En corto**

- API: you ask for things or create them from your system.
- Webhooks: the platform tells you when something happens, without you asking.
- External storage: documents are replicated into your own repository.
- An API key is created with just the permissions it needs, not all of them.

## Which one to use

| You want | Use | Example |
| --- | --- | --- |
| To create something from your system | API | The ERP registers a supplier and launches the document process |
| To find out something happened | Webhook | Notify your system when a contract is fully signed |
| The files in your repository too | External storage | Everything certified also appears in your corporate folder |
| To query occasionally | API | A monthly report reading the state of your cases |

_If you find yourself polling every few minutes to see whether something changed, what you needed was a webhook._

## API keys

Created from the organisation settings, with the permissions that integration needs and no more. A key that only has to certify documents should not be able to delete contacts. And one key per integration is worth it, so you can revoke one without breaking the others.

> [!IMPORTANT]
> An API key grants access to your organisation's data. It must not end up in a code repository, an email or a chat message. If you suspect one has been exposed, revoke it: creating another takes a minute.

## Webhooks

You provide a URL and the platform notifies you when whatever you subscribed to happens. What matters when building it is that your end responds quickly and tolerates receiving the same notice twice: any delivery system can retry, and processing it twice should not duplicate anything on your side.

## Frequently asked questions

**Where is the API documentation?**

On the public API documentation page, with endpoints and parameters. This article is the overview; the detail lives there.

**Can I certify automatically from my ERP?**

Yes, and it is one of the most frequent uses: each invoice or record is certified as it is generated, with nobody having to remember.

**What if my endpoint is down when a webhook fires?**

It is retried. Which is why your end should tolerate receiving the same notice more than once.

**Does external storage move or copy?**

It replicates: documents stay on the platform with their traceability and also appear in your repository.

## Ejemplos

**A company wants every invoice issued by its ERP certified with no human involvement.**

- Creates an API key with certify-only permission
- The ERP calls the API at the moment the invoice is issued
- Subscribes a webhook to record the evidence identifier back in the ERP

→ Every invoice carries a demonstrable date from the second it exists, and nobody has to remember anything.

**A contractor onboards eighty subcontractors a year in their ERP and somebody retypes the same data here.**

- The ERP calls the API as soon as the subcontractor is created
- The documentation process launches by itself with that data
- The ERP gets a notification when the file completes

→ Double keying disappears for eighty onboardings, and the ERP knows who may enter site without being told.

**Purchasing checks two screens to know whether a supplier is current.**

- Brings the file's status into the system where the order is approved
- Updates that status whenever it changes here

→ The order is approved on the screen where people were already working.

**Everything is integrated at once and two months later nobody knows what each connection does.**

- Integrates the most repeated flow first
- Documents what triggers what before adding the second

→ The second integration is built on something understood rather than a black box.

**The ERP sends incomplete data and half-built files get created.**

- Validates the mandatory fields before creating anything
- Returns the error to whoever generated it instead of creating the file

→ The files that exist are complete, and the error is fixed in the system where it started.

**Nobody knows whether the integration still works until a file is missing.**

- Reviews the call log weekly
- Sets an alert if activity stops arriving

→ The break is caught in hours rather than when somebody misses something.