Developers

Quickstart

Go from zero to a completed lesson and a compliance report in about five minutes, using nothing but curl and the public sandbox. No account, no signup, no configuration.

The sandbox

Every example below runs against the shared sandbox tenant Acme Logistics with this key. It is public by design and only ever resolves to sandbox data:

tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA
  • Employees E-1001 through E-1008; the walkthrough uses E-1001
  • Shared and writable; everything resets nightly at 04:00 UTC
  • Rate limited to 60 requests per minute per IP address
  • Base URL for all calls: https://toolboxminute.com/api

1 Ask where E-1001 stands today

GET/api/v1/employees/{externalId}/today

One call answers the only question most integrations need: has this employee finished today's lesson? Copy and run:

# Check today's status for sandbox employee E-1001
curl "https://toolboxminute.com/api/v1/employees/E-1001/today" \
  -H "X-Api-Key: tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA"

2 Read the response

You get today's status plus, because the lesson is not finished yet, a single-use launchUrl. Your lesson title and date will differ; the shape will not:

{
  "externalId": "E-1001",
  "lessonDate": "2026-07-15",
  "status": "not_started",
  "lesson": {
    "lessonId": "7d0e3c2a-4b91-4f6e-9a35-c8f2d1e0b647",
    "title": "Pedestrian Awareness",
    "videoDurationSeconds": 90
  },
  "subTopic": "Forklift Safety",
  "topic": "Powered Equipment",
  "launchUrl": "https://toolboxminute.com/viewer/start?token=kX3vQ9..."
}
FieldTypeNotes
externalIdstringYour identifier for the employee, echoed back.
lessonDatestringyyyy-MM-dd, the employee's local "today".
statusstringOne of the four values below.
lessonobject or nulllessonId (uuid), title, videoDurationSeconds. Null when nothing is scheduled.
subTopicstring or nullThe safety subtopic the lesson belongs to.
topicstring or nullThe parent topic.
launchUrlstring or nullPresent only while the lesson is incomplete. Single use, expires after about 30 minutes; call /today again for a fresh one.
The four possible statuses
completedfinished today's lesson
in_progressstarted, not done
not_startedhas not begun
no_lesson_schedulednothing due today

3 Open the launch URL and finish the lesson

Paste the launchUrl into a browser. That is the exact experience an employee gets from your WMS, kiosk, or daily email: the token signs them in anonymously, the 90 second video plays, and a short quiz confirms they were paying attention. Complete both.

In production you would pass ?returnUrl= on the /today call to control where the employee lands after finishing. Return URLs are exact-match allowlisted per tenant; an unlisted value fails with 400 invalid_return_url.

4 Ask again and see the answer change

Re-run the exact same call from step 1. The status is now completed and no launch URL is issued, because there is nothing left to launch:

{
  "externalId": "E-1001",
  "lessonDate": "2026-07-15",
  "status": "completed",
  "lesson": {
    "lessonId": "7d0e3c2a-4b91-4f6e-9a35-c8f2d1e0b647",
    "title": "Pedestrian Awareness",
    "videoDurationSeconds": 90
  },
  "subTopic": "Forklift Safety",
  "topic": "Powered Equipment",
  "launchUrl": null
}

This loop, ask, redirect, ask again, is the whole integration. Your system decides what a not_started answer means: block a task, nudge a supervisor, or just record it.

5 Pull the compliance roll-up

GET/api/v1/reports/compliance

Reporting endpoints see the completion you just made. The compliance summary is today's tenant-wide roll-up, ready for a BI dashboard or a morning email:

# Today's compliance summary for the whole tenant
curl "https://toolboxminute.com/api/v1/reports/compliance" \
  -H "X-Api-Key: tbm_test_wWlSr6q-BPXUN67BPbzyVhR703QGmSlk34EEWGqRBtA"

# 200 OK
{
  "activeEmployees": 8,
  "completedToday": 1,
  "expectedToday": 8,
  "compliancePercentToday": 12.5,
  "activeBadges": 4,
  "expiringSoon": 1
}

That completedToday: 1 is you. Other reporting endpoints cover per-employee history, daily and date-range activity feeds, and badge expiry.

Going live

Three changes take this walkthrough to production:

1

Create a live key

In the admin console, go to Admin > Settings and use the API keys (company token) card. Name the key after the system that will hold it. The raw key is shown exactly once, so copy it immediately.

2

Confirm API access

The integration API is an entitlement: free during your trial, a paid add-on after. Without it every call returns 402 api_access_required, even with a valid key.

3

Swap the key

Replace the tbm_test_ key with your tbm_live_ key. Same headers, same endpoints, but now scoped to your own tenant and rate limited at 300 requests per minute per key.

Next: read Authentication for key classes, rotation, and the exact error bodies, or point your tooling at the machine-readable OpenAPI document at https://toolboxminute.com/api/openapi/v1.json.