Quickstart
Go from zero to a completed lesson and a compliance report in about five minutes, using nothing but curl and the public sandbox. No account, no signup, no configuration.
The sandbox
Every example below runs against the shared sandbox tenant Acme Logistics with this key. It is public by design and only ever resolves to sandbox data:
tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA
- Employees
E-1001throughE-1008; the walkthrough usesE-1001 - Shared and writable; everything resets nightly at 04:00 UTC
- Rate limited to 60 requests per minute per IP address
- Base URL for all calls:
https://toolboxminute.com/api
1 Ask where E-1001 stands today
One call answers the only question most integrations need: has this employee finished today's lesson? Copy and run:
# Check today's status for sandbox employee E-1001 curl "https://toolboxminute.com/api/v1/employees/E-1001/today" \ -H "X-Api-Key: tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA"
2 Read the response
You get today's status plus, because the lesson is not finished yet, a single-use
launchUrl. Your lesson title and date will differ; the shape will not:
{
"externalId": "E-1001",
"lessonDate": "2026-07-15",
"status": "not_started",
"lesson": {
"lessonId": "7d0e3c2a-4b91-4f6e-9a35-c8f2d1e0b647",
"title": "Pedestrian Awareness",
"videoDurationSeconds": 90
},
"subTopic": "Forklift Safety",
"topic": "Powered Equipment",
"launchUrl": "https://toolboxminute.com/viewer/start?token=kX3vQ9..."
}
| Field | Type | Notes |
|---|---|---|
externalId | string | Your identifier for the employee, echoed back. |
lessonDate | string | yyyy-MM-dd, the employee's local "today". |
status | string | One of the four values below. |
lesson | object or null | lessonId (uuid), title, videoDurationSeconds. Null when nothing is scheduled. |
subTopic | string or null | The safety subtopic the lesson belongs to. |
topic | string or null | The parent topic. |
launchUrl | string or null | Present only while the lesson is incomplete. Single use, expires after about 30 minutes; call /today again for a fresh one. |
3 Open the launch URL and finish the lesson
Paste the launchUrl into a browser. That is the exact experience an employee gets
from your WMS, kiosk, or daily email: the token signs them in anonymously, the 90 second video
plays, and a short quiz confirms they were paying attention. Complete both.
In production you would pass ?returnUrl= on the /today call to control
where the employee lands after finishing. Return URLs are exact-match allowlisted per tenant;
an unlisted value fails with 400 invalid_return_url.
4 Ask again and see the answer change
Re-run the exact same call from step 1. The status is now completed and no launch
URL is issued, because there is nothing left to launch:
{
"externalId": "E-1001",
"lessonDate": "2026-07-15",
"status": "completed",
"lesson": {
"lessonId": "7d0e3c2a-4b91-4f6e-9a35-c8f2d1e0b647",
"title": "Pedestrian Awareness",
"videoDurationSeconds": 90
},
"subTopic": "Forklift Safety",
"topic": "Powered Equipment",
"launchUrl": null
}
This loop, ask, redirect, ask again, is the whole integration. Your system decides what a
not_started answer means: block a task, nudge a supervisor, or just record it.
5 Pull the compliance roll-up
Reporting endpoints see the completion you just made. The compliance summary is today's tenant-wide roll-up, ready for a BI dashboard or a morning email:
# Today's compliance summary for the whole tenant curl "https://toolboxminute.com/api/v1/reports/compliance" \ -H "X-Api-Key: tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA" # 200 OK { "activeEmployees": 8, "completedToday": 1, "expectedToday": 8, "compliancePercentToday": 12.5, "activeBadges": 4, "expiringSoon": 1 }
That completedToday: 1 is you. Other reporting endpoints cover per-employee
history, daily and date-range activity feeds, and badge expiry.
Going live
Three changes take this walkthrough to production:
Create a live key
In the admin console, go to Admin > Settings and use the API keys (company token) card. Name the key after the system that will hold it. The raw key is shown exactly once, so copy it immediately.
Confirm API access
The integration API is an entitlement: free during your trial, a paid add-on after.
Without it every call returns 402 api_access_required, even with a
valid key.
Swap the key
Replace the tbm_test_ key with your tbm_live_ key. Same
headers, same endpoints, but now scoped to your own tenant and rate limited at 300
requests per minute per key.
Next: read Authentication for key classes,
rotation, and the exact error bodies, or point your tooling at the machine-readable OpenAPI
document at https://toolboxminute.com/api/openapi/v1.json.