# Guardhouse > REST API reference for Guardhouse incident reports, live operations, and webhooks. ## Docs - [Introduction](https://docs.guardhousehq.com/index.md): REST API for incident reports, live operations, timesheets, staff, customers, sites, and webhooks. - [Errors](https://docs.guardhousehq.com/api-reference/errors.md): How error responses are structured and how to interpret status codes. - [Webhooks](https://docs.guardhousehq.com/api-reference/webhooks.md): Subscribe to Guardhouse events, validate signatures, and handle deliveries. - [Request a bearer token](https://docs.guardhousehq.com/api-reference/authentication/request-a-bearer-token.md): Exchanges a long-lived API key for a short-lived JWT bearer token. Send the returned `accessToken` as `Authorization: Bearer ` on every subsequent API request. - [List incident reports](https://docs.guardhousehq.com/api-reference/incident-reports/list-incident-reports.md): Returns a paginated list of incident reports scoped to your API key's company, customers, and sites. Use `direction` and `referenceId` (the last `incidentReportId` you saw) for cursor-based pagination. - [Get full incident report detail](https://docs.guardhousehq.com/api-reference/incident-reports/get-full-incident-report-detail.md): Returns the full report including every question, answer, and attachment metadata for a single incident report. - [Download an incident report as PDF](https://docs.guardhousehq.com/api-reference/incident-reports/download-an-incident-report-as-pdf.md): Streams a rendered PDF of the incident report. Response `Content-Type` is `application/pdf`; the JSON envelope is **not** used for this endpoint. - [List incident reports by form template](https://docs.guardhousehq.com/api-reference/incident-reports/list-incident-reports-by-form-template.md): Returns incident reports submitted against a specific form template, filtered to your API key's scope. - [List form templates](https://docs.guardhousehq.com/api-reference/incident-reports/list-form-templates.md): Returns the form templates available to your API key. Useful for populating the `id` parameter on `/api/external/incidentreport/formtemplate`. - [List timesheet entries](https://docs.guardhousehq.com/api-reference/timesheets/list-timesheet-entries.md): Returns a paginated list of timesheet entries within the given date range, scoped to your API key's customers and sites. Requires an API key with `KeyType=timesheet`. - [Get a timesheet entry](https://docs.guardhousehq.com/api-reference/timesheets/get-a-timesheet-entry.md): Returns the full detail for a single timesheet entry by ID. The entry must belong to your API key's company, customers, and sites. Requires an API key with `KeyType=timesheet`. - [Get a timesheet entry's rate breakdown](https://docs.guardhousehq.com/api-reference/timesheets/get-a-timesheet-entrys-rate-breakdown.md): Returns the pay rate, service rate, and allowance breakdown for a single timesheet entry. - [Search staff by email](https://docs.guardhousehq.com/api-reference/staff/search-staff-by-email.md): Returns a single employee record matching the given email address, scoped to your API key's company. Requires an API key with `KeyType=developer`. - [List staff](https://docs.guardhousehq.com/api-reference/staff/list-staff.md): Returns a paginated list of employees visible to your API key. Requires `KeyType=developer`. - [Create employees](https://docs.guardhousehq.com/api-reference/staff/create-employees.md): Creates one or more employee records under your API key's company. `firstName`, `lastName`, and `email` are required per employee. Optionally attach initial security licenses in the same request. Requires an API key with `KeyType=developer`. - [Bulk update employees](https://docs.guardhousehq.com/api-reference/staff/bulk-update-employees.md): Partially updates one or more employee records. Only fields that are present in the request body are written — omitting a field leaves the existing value unchanged. Requires an API key with `KeyType=developer`. - [Upsert a staff member's security licenses](https://docs.guardhousehq.com/api-reference/staff/upsert-a-staff-members-security-licenses.md): Creates or updates security licenses for a single employee. Pass `licenseId` to update an existing license; omit it (or pass `null`) to create a new one. Requires an API key with `KeyType=developer`. - [List a staff member's security licenses](https://docs.guardhousehq.com/api-reference/staff/list-a-staff-members-security-licenses.md): Returns the security licenses on file for a single employee, including expiry, status, and any attachment links. Requires `KeyType=developer`. - [List customers](https://docs.guardhousehq.com/api-reference/customers/list-customers.md): Returns a paginated list of customers visible to your API key. - [List sites](https://docs.guardhousehq.com/api-reference/sites/list-sites.md): Returns a paginated list of sites visible to your API key. - [Create a webhook subscriber](https://docs.guardhousehq.com/api-reference/webhooks/create-a-webhook-subscriber.md): Provisions a subscriber record for your company. The response includes a `secretToken` you will use to validate the HMAC signature on every incoming webhook delivery — store it securely; it is shown only on creation and on rotation. - [Create an event subscription](https://docs.guardhousehq.com/api-reference/webhooks/create-an-event-subscription.md): Subscribes a delivery URI to a specific event/eventType pair. See the [Webhooks guide](/api-reference/webhooks) for the full event catalog. - [List a subscriber's subscriptions](https://docs.guardhousehq.com/api-reference/webhooks/list-a-subscribers-subscriptions.md): Returns every event subscription owned by the given subscriber. - [Update a subscriber](https://docs.guardhousehq.com/api-reference/webhooks/update-a-subscriber.md): Activates/deactivates a subscriber or rotates its `secretToken`. When `rotateSecretToken` is `true`, the response contains the new token — the previous token will no longer validate signatures. - [Update a subscription](https://docs.guardhousehq.com/api-reference/webhooks/update-a-subscription.md): Updates the delivery URI or active state of a subscription. - [List login audit events](https://docs.guardhousehq.com/api-reference/login-audit/list-login-audit-events.md): Returns login audit events for the caller's company, newest first. - [Recent login activity for a user](https://docs.guardhousehq.com/api-reference/login-audit/recent-login-activity-for-a-user.md): Returns the most recent login audit events for a single user in the caller's company. Use this for a quick "what's this user been up to" view; use the list endpoint when you need date ranges or pagination. - [List live operations](https://docs.guardhousehq.com/api-reference/live-operations/list-live-operations.md): Returns live operational records for shifts and employees. Use filters such as date range, site, customer, employee name, subcontractor, and status to narrow results. If `startDate` or `endDate` is omitted, the API defaults to a 34-hour window around the current UTC time (`now - 17 hours` through `n… ## OpenAPI Specs - [openapi](https://docs.guardhousehq.com/api-reference/openapi.json)