For the Mycorra team — the only API consumers

Partner API

Everything the Mycorra admin does on this website, as API calls — one section per admin tab. You log in once with your usual staff email and password; every call after that carries the token it returns. A token can do only what your account can see on the website.

🔐Why this API needs a login. Your token reaches every business, every job and the work log, so it authenticates exactly like the website. Business owners never call this API; you hold their usernames and act for them (Part 2).

Quick start

  1. Log in once — POST /api/staff/login with your staff email and password. It returns a token. Store it server-side, never in a browser page.
  2. Call any section below with the header Authorization: Bearer <token>. The token lasts 30 days; log in again to renew, or revoke it with POST /api/staff/logout.
◍Same permissions, no shortcuts. If your account lacks a tab, its endpoints return 403 — exactly as the website does. The API can never widen what you can see. The IP whitelist in Security controls applies to API calls too.

Rules for every endpoint

  • Base URL: https://teepwork.com — every path below attaches to it.
  • Auth header: Authorization: Bearer <token> on everything except login. (A ?token= fallback exists for hosts that strip the header. It is discouraged because the token ends up in logs.)
  • Format: JSON responses carry "ok": true/false. Errors look like {"ok":false,"error":"…"}. The three PDF/CSV downloads return the file itself.
  • Input: POST endpoints accept form fields or a JSON body (Content-Type: application/json).
  • Tokens: only a hash is stored; the raw token is shown once, at login. Logging out revokes just the token you send.
  • Money is server-computed. You send the level and hours; the capacity rate and any listed pay come from the platform settings, never from your request.
  • First-time setup: a superadmin must apply migrations/0030_staff_api_tokens.sql once before login works.

Send a section to the Mycorra team

Each tab below has its own link. Copy the one you need:

Part 1 — Mycorra staff API

Log in, then run each Mycorra admin tab from your own portal.

Account — login, who am I, notifications, logout

Every Mycorra login starts here. These calls work for any valid Mycorra token.

Website tab: /account-settings
Send this section: https://teepwork.com/partner-api#account

POST 1 · Log in (get a token) — /api/staff/login

Send your staff email + password (the ones you use on this website). Optional label names the token. Returns token, its lifetime, your role, and the exact pages the token may reach. The same lockout rules as the website apply to wrong passwords.

TOKEN=$(curl -s -X POST https://teepwork.com/api/staff/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "job@teepwork.com",
    "password": "your-staff-password",
    "label": "Mycorra portal"
  }' | php -r 'echo json_decode(stream_get_contents(STDIN), true)["token"];')

echo "$TOKEN"   # store this server-side; reuse it on every call below

Success → {"ok":true,"token":"…","token_type":"Bearer","expires_in_days":30,"staff":{…},"pages":["dashboard","businesses","post-work","qa-review","work-log","edit-work-unit"]}. The pages list is your tab list.

GET 2 · Who am I? (health check) — /api/staff/me

Confirms the token is still valid and lists the tabs it may call. A good first call after startup — a 401 means log in again.

curl https://teepwork.com/api/staff/me -H "Authorization: Bearer $TOKEN"
GET 3 · Notifications — /api/staff/notifications · website: the bell in the top bar, and Notifications

Your notification feed, newest first, with the unread count. Each item carries an absolute link to the place it refers to. Params: page, per_page (max 100).

curl "https://teepwork.com/api/staff/notifications?per_page=20" -H "Authorization: Bearer $TOKEN"
POST 4 · Log out (revoke this token) — /api/staff/logout

Revokes only the token you send — retiring one integration never logs the team out of the website or other tokens. Log in again (endpoint 1) to get a new one.

curl -X POST https://teepwork.com/api/staff/logout -H "Authorization: Bearer $TOKEN"

Tab 1 — Dashboard

The Mycorra view of the platform: the six headline numbers, jobs by status, and the 8-week posting trend. Also the badge count for the acceptance queue.

Website tab: /admin/dashboard
Send this section: https://teepwork.com/partner-api#tab-dashboard

GET Dashboard numbers — /api/staff/dashboard · website: Dashboard

Returns jobs_posted, active_jobs, awaiting_teep (in the work pool), delivered_this_week, avg_business_rating_out_of_5, repeat_business_rate_pct, acceptance_queue, jobs_by_status (count + label per status) and trend_last_8_weeks.

curl https://teepwork.com/api/staff/dashboard -H "Authorization: Bearer $TOKEN"

Tab 2 — Businesses

The business directory, onboarding, tier and status, and each business's username (order_code) and work-order link. Every business row returns its order_code, so you always have the username to send them.

Website tab: /admin/businesses
Send this section: https://teepwork.com/partner-api#tab-businesses

GET Business directory (with usernames) — /api/staff/businesses · website: Businesses

Every business, newest first, with tier, status, work-order count and its order_code. If a business has no username yet, it is created on this call, exactly as the website's "Copy link" does. Filters: q (company, contact or email), status (pending|active|paused|offboarded), tier (starter|growth|pro), page, per_page (max 100).

curl "https://teepwork.com/api/staff/businesses?q=skincare&status=active" -H "Authorization: Bearer $TOKEN"
POST Onboard a business — /api/staff/business-create · website: Businesses → “Onboard a new business”

Creates a business (status: active), queues its welcome email, and returns the new business_id, its order_code (username) and order_link at once. Required: company_name, contact_name, email. Optional: phone, membership_tier (starter|growth|pro, default starter).

curl -X POST https://teepwork.com/api/staff/business-create \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "company_name": "Acme Skincare",
    "contact_name": "Jane Smith",
    "email": "jane@acme.com",
    "phone": "+1 555 0100",
    "membership_tier": "growth"
  }'
POST Change a business tier or status — /api/staff/business-update · website: Businesses → tier / status dropdowns

Two editable fields only. field=membership_tier → starter|growth|pro; field=status → pending|active|paused|offboarded. Anything else is rejected.

curl -X POST https://teepwork.com/api/staff/business-update \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"business_id": 12, "field": "status", "value": "paused"}'

Tab 3 — Post a job

Post a job straight into the TEEP WORK work pool, look up the work categories, and download the Post-a-job guide. This is the work-order posting feature.

Website tab: /admin/post-work
Send this section: https://teepwork.com/partner-api#tab-post-a-job

GET Work categories (posting dropdown) — /api/staff/skill-categories · website: the “Category” dropdown on Post a job

The shared category list with ids. Fetch it once and cache it. You may skip it and send skill_name instead — a known name is reused, an unknown one is created.

curl https://teepwork.com/api/staff/skill-categories -H "Authorization: Bearer $TOKEN"
POST Post a job (straight to the pool) — /api/staff/post-work · website: Post a job

Posts for any business as available_pool, visible to workers at once. Required: business_id, title, description, estimated_hours, and a category: skill_category_id, skill_name, or skill_category_id=other with new_skill_name. Optional brief fields: business_need, work_requested, deliverables, required_capabilities, quality_criteria, completion_standard, instructions, revision_policy, expected_output, training_video_url, video_visibility (assigned_only|matched_preview|public_preview), complexity_tier (bronze|silver|gold), capability_level (L1–L4, or CUSTOM with custom_level_label and custom_capacity_rate_usd), estimated_work_units, workers_needed, deadline (YYYY-MM-DD HH:MM:SS).

curl -X POST https://teepwork.com/api/staff/post-work \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "business_id": 12,
    "skill_name": "Market Research",
    "title": "Competitor pricing research for our skincare line",
    "description": "Compare 5 competing brands on price, positioning and reviews.",
    "deliverables": "One spreadsheet with 5 competitors plus a 1-page summary",
    "complexity_tier": "bronze",
    "capability_level": "L2",
    "estimated_hours": 4,
    "estimated_work_units": 2,
    "workers_needed": 1,
    "deadline": "2026-11-30 17:00:00"
  }'

Response: work_unit_id, status, capability_level, capacity_rate_usd, message. The capacity rate is the amount TEEP WORK pays per accepted unit; it is computed on the server.

GET Post-a-job guide (PDF or CSV) — /api/staff/post-guide?format=pdf|csv · website: “PDF guide” / “Excel (CSV)” on Post a job

Every field of the form, whether it is required, what to write, and a placeholder example. The response is the file itself: format=pdf (A4) or format=csv (opens in Excel).

curl -o "Post-a-job guide.pdf" "https://teepwork.com/api/staff/post-guide?format=pdf" -H "Authorization: Bearer $TOKEN"

Tab 4 — Acceptance review

The Mycorra acceptance decision. Work that TEEP WORK has already quality-checked comes here. You decide on the deliverable; worker identity is withheld by design.

Website tab: /admin/qa-review
Send this section: https://teepwork.com/partner-api#tab-acceptance

GET Acceptance queue — /api/staff/acceptance-queue · website: Acceptance review

Each waiting delivery with its deliverable link (file_url opens directly), revision number, business and brief context, deadline and on_time, the timing label, milestones (done of total), and help_ticket_open. If a help ticket is open, approval is paused until the coordinator mediates it, so read this before you decide.

curl https://teepwork.com/api/staff/acceptance-queue -H "Authorization: Bearer $TOKEN"
POST Record the acceptance decision — /api/staff/acceptance-decision · website: Acceptance review → Approve / Request revision / Reject

Decide on a submission from the queue. decision = approved (marks the job delivered once every slot is in, releases worker pay, and closes the job), revision_requested (sends it back to the worker), or rejected (removes that worker; the job reopens if no slots remain). Add notes for the record.

curl -X POST https://teepwork.com/api/staff/acceptance-decision \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"submission_id": 88, "decision": "approved", "notes": "Meets the brief."}'

Approval returns 409 while a help ticket is open. Revisions and rejections still work. A token can never record the TEEP WORK first-pass review, so the two-layer model holds.

POST Rate a delivery (1–5 stars) — /api/staff/rate-delivery · website: Acceptance review → “Rate this delivery”

Your quality rating on a delivery waiting in your queue. It is saved on the Mycorra layer, and the worker sees only the stars, never who rated them. Only assignment_id values from the queue are accepted; anything else returns 409.

curl -X POST https://teepwork.com/api/staff/rate-delivery \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"assignment_id": 42, "stars": 5, "comment": "Accurate and well sourced."}'

Tab 5 — Work log / invoice

The monthly billing workspace: Document 1 (jobs posted in the month), Document 2 (approved works with the capacity and worker-pay breakdown, plus the per-worker payout breakdown) and Document 3 (workers assigned and completed). The figures match the PDFs exactly.

Website tab: /admin/work-log
Send this section: https://teepwork.com/partner-api#tab-work-log

GET Work log / invoice data — /api/staff/work-log?month=YYYY-MM · website: Work log / invoice

Both documents as JSON: document_1_posted_jobs (count, units, value, rows) and document_2_completed_works (count, capacity, worker pay, by_worker rollup, rows). Defaults to the current month.

curl "https://teepwork.com/api/staff/work-log?month=2026-10" -H "Authorization: Bearer $TOKEN"
GET Work log PDFs (landscape) — /api/staff/work-log-pdf?doc=posted|completed|workers&month=YYYY-MM · website: “Download landscape PDF” buttons on Work log / invoice

The three PDFs, one per document: doc=posted (Document 1), doc=completed (Document 2), doc=workers (Document 3). The response is the PDF file.

curl -o "work-log-2026-10.pdf" "https://teepwork.com/api/staff/work-log-pdf?doc=completed&month=2026-10" -H "Authorization: Bearer $TOKEN"

Tab 6 — Edit a job

Correct a posted job's brief, scope or level while it is still editable. The picker lists the jobs you can edit; the editor shows one job in full.

Website tab: /admin/edit-work-unit
Send this section: https://teepwork.com/partner-api#tab-edit-a-job

GET Editable jobs (picker) — /api/staff/jobs?status=available_pool,assigned,paused · website: Edit a job (no job selected)

The jobs that can still be edited: in the pool, assigned, or paused. Pass a comma-separated status list. Also filter by business_id or search with q; paginate with page and per_page. Each row includes the business order_code.

curl "https://teepwork.com/api/staff/jobs?status=available_pool,assigned,paused" -H "Authorization: Bearer $TOKEN"
GET One job in full — /api/staff/job-detail?work_unit_id=… · website: Edit a job (with a job selected)

The full brief, scoping (level, hours, units, live capacity), staffing counts, deadline, whether it is still editable, and its status_history. Worker names are not shown here. Listed (talent-facing) pay is shown only to superadmin accounts, as on the website.

curl "https://teepwork.com/api/staff/job-detail?work_unit_id=42" -H "Authorization: Bearer $TOKEN"
POST Save a job edit — /api/staff/edit-work-unit · website: Edit a job → Save changes

Send work_unit_id plus the fields to change (same names as Post a job). Three safeguards match the website: only pool, assigned or paused jobs can be edited (409 otherwise); workers_needed cannot drop below the slots already filled; and once a slot is filled the capacity is frozen, so level, hours, units, rate type and custom rate are refused. Editing an assigned job notifies its worker.

curl -X POST https://teepwork.com/api/staff/edit-work-unit \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{
    "work_unit_id": 42,
    "title": "Competitor pricing research (revised scope)",
    "description": "Compare 8 competing brands on price, positioning and reviews.",
    "complexity_tier": "bronze",
    "capability_level": "L2",
    "rate_type": "fixed",
    "estimated_hours": 4,
    "estimated_work_units": 2,
    "workers_needed": 1,
    "deadline": "2026-12-05 17:00:00"
  }'

Optional tabs — only if the superadmin grants them

These tabs are not part of the default Mycorra set. If the superadmin adds them in Staff roles, the endpoints below work. Otherwise they return 403.

GET Received orders (Work orders tab) — /api/staff/jobs?status=submitted · website: Work orders (superadmin)

Orders a business has submitted and that are still Received — Mycorra is reviewing it. Accounts without the Work orders tab get 403 for these statuses.

curl "https://teepwork.com/api/staff/jobs?status=submitted" -H "Authorization: Bearer $TOKEN"
POST Fix a received order — /api/staff/update-submitted-order · website: Work orders

Corrects an order that is still Received. Send work_unit_id plus only the fields to change: title (8+ characters), description (20+), deliverables, skill_category_id or skill_name, workers_needed (1–20), deadline (empty clears it), submitter_name, submitter_contact. Past review, use Save a job edit.

curl -X POST https://teepwork.com/api/staff/update-submitted-order \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"work_unit_id": 42, "workers_needed": 2, "deadline": "2026-12-15 17:00:00"}'
POST Withdraw a received order — /api/staff/cancel-job · website: Work orders

Withdraws an order that is still Received — for example a duplicate, or a business that changed its mind. It is removed before any worker sees it. Orders past review return 409 and are unwound on the website.

curl -X POST https://teepwork.com/api/staff/cancel-job \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"work_unit_id": 42}'
POST Rate finished work for a business (1–5) — /api/staff/job-feedback · website: Job updates

Records the business's rating for a delivered job. It closes the job (delivered → closed) and feeds the rating into each worker's trust score. One rating per job: resending the same rating is safe; a different one returns 409.

curl -X POST https://teepwork.com/api/staff/job-feedback \
  -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
  -d '{"job_id": 42, "rating": 5, "comments": "Thorough, delivered a day early."}'

Troubleshooting

  • Missing bearer token… (401) — send Authorization: Bearer <token>. If your host strips the header, use ?token=.
  • Invalid or expired token… (401) — 30 days passed, you logged out, or the token was revoked. Log in again.
  • This API is for the Mycorra team (admin) and superadmin accounts only. (403) — you signed in with a coordinator or worker account.
  • Your staff account does not have access to "…" (403) — that tab is not on your account. Ask the superadmin in Staff roles.
  • Received orders are on the Work orders tab… (403) — the Work orders tab is not on your account.
  • Staff API not enabled yet… (503) — a superadmin must apply migrations/0030_staff_api_tokens.sql once.
  • Incorrect email or password. (401) / Too many failed attempts… (429) — same lockout rules as the website.
  • …can no longer be edited… or Capacity is frozen… (409) — the job is in progress or a slot is filled. Use a QA revision, or post a new job for a different scope.
  • This submission is not ready for the Mycorra layer… (409) — TEEP WORK has not approved the first pass yet, or a decision is already recorded.
  • A help ticket is open on this task… (409) — approval is paused until the coordinator mediates it. Revisions and rejections still work.
  • This delivery is not waiting in your acceptance queue… (409) — rate only the deliveries listed by the acceptance queue.

Part 2 — Business usage (no API)

Business owners do not call this API. They use the TEEP WORK website, with the username and link you give them. Everything in Part 1 is what you do for them.

Giving a business its username and link

  1. Onboard the business (Tab 2, business-create) — or find it in the directory (businesses). Both return its order_code.
  2. Send the business its username (order_code) in your message. Send the link (order_link) if you want them to skip the username step. Treat the link as a secret.
  3. If a link leaks, call business-order-link with action=regenerate. The username stays the same; the old link stops working.

What the business does on the website

  1. Opens the work-order link (or the public Businesses page and enters the username).
  2. Describes the work and submits it. The order is Received — Mycorra is reviewing it. Nothing reaches a worker until it is scoped and posted.
  3. Sees the job move through its stages on the website, and rates the finished work when it is delivered.

Business pages

WhatPageWho
Work-order form (order by link or username)https://teepwork.com/work-orderBusiness — no login needed
This documentationhttps://teepwork.com/partner-apiPublic — send to the Mycorra team