Features
Everything behind one API
48 capabilities in five groups, all in the open-source code on GitHub. Business modules are switched on per deployment, so a product only carries what it uses.
Sign-in and security
One sign-in for every app, with the protections each app would otherwise rebuild.Email and password
bcrypt passwords, lockout after failed attempts, per-IP rate limits, reset links only to trusted origins.
Two-factor codes
Six-digit codes by email; each workspace owner decides whether members need one. Platform admins always do.
Google and Apple
Google OAuth and Sign in with Apple, on the web and from native apps (ID token validation).
SAML single sign-on
Each workspace connects its own SAML 2.0 identity provider (Okta, Entra ID, Google Workspace, OneLogin, Keycloak…): metadata import, signed-response checks, sign-in by email domain and accounts created on first sign-in.
Hosted sign-in page
“Sign in with OpsAPI” at /auth/signin: apps redirect there and get a token back, with silent sign-in when a session exists.
Refresh tokens and PIN
Rotating refresh tokens in an HttpOnly cookie or body, plus an optional PIN for quick unlock.
API keys
Long-lived keys for servers and scripts, scoped to a workspace.
Audit trail and activity
Sign-in events, user activity and an audit trail of changes, per workspace.
Workspaces and roles
Multi-tenant from the first table: every business row carries its workspace.Workspaces (namespaces)
Resolved per request from a header, the JWT or the subdomain; members, owners and invitations.
Roles and permissions
module.action permissions (manage = everything) on roles per workspace; owner, admin, member seeded.
Groups and invitations
Invite by email, accept by link, group people for assignment.
Backend-driven menu
The dashboard sidebar comes from the API, per workspace and role.
Workspace mail and AI providers
Each workspace can bring its own outgoing mail settings and AI model provider.
Employees
People records that other modules (timesheets, field service) build on.
Platform and extension
Grow the API without forking it.Feature presets
PROJECT_CODE picks which modules a deployment loads; disabled modules have no routes and no tables.
Plugins
A folder of Lua gets auth, tenancy, RBAC, migrations, dashboard pages, event listeners and scheduled jobs.
Outbound webhooks
Workspaces send their events to their own URLs, signed and retried.
OpenAPI and Swagger
The spec at /openapi.json and an explorer at /swagger, generated from the routes.
TypeScript SDK
@opsapi/client: typed calls for every endpoint, sign-in with 2FA, pagination, retries and webhook checks.
Error catalog
Every error has a code, a human message and a correlation id, recorded for support.
Themes
WordPress-style themes per workspace for public pages.
Secret vault
Encrypted secrets per workspace with pluggable vault providers.
GitHub services
Trigger and track GitHub workflows, plus domain management.
Business modules
Switch on the ones a product needs.CRM
Accounts, contacts, deals, pipelines, activities and public lead capture.
Invoicing
Invoices, PDFs, payments and templates.
Accounting
Bookkeeping, VAT returns and trial balance, with AI-assisted categorisation.
UK tax filing (HMRC MTD)
Bank statement extraction, AI classification and Making Tax Digital submission with anti-fraud headers.
Bank transactions
Import and track bank transactions.
Timesheets
Time entry and approval.
Kanban
Projects, boards, sprints, epics, tasks, labels and time tracking.
Chat
Channels, messages, mentions and reactions, with an AI agent.
Push notifications
Device tokens with FCM and APNs delivery.
E-commerce
Stores, products, variants, carts, orders and Stripe payments.
Delivery
Delivery partners, verification, pricing, requests and assignments.
Reviews
Product and store reviews.
AI hardware shop
Configurable catalogue, quotes, carts, Stripe checkout and RAG-backed chat.
Billing and entitlements
Apps, plans, subscriptions, entitlements and signed licences.
Hospital and care
Hospitals, wards, patients, care plans, medications, care logs and access controls.
Field service
Service requests, jobs, site visits, assets, parts, contracts and reports.
Academy (LMS)
Courses and lessons with rich content, instructors and paid enrolment.
CMS
Website pages and blog posts with media, taxonomy and rebuild webhooks.
Forms
Public forms, responses and records created from them.
Hiring (ATS)
Jobs, candidates and AI first-round interviews.
Running it
Built to be operated, not just installed.One container
bwalia/opsapi on Docker Hub: OpenResty with Lua in the Nginx workers, no separate app server.
Local stack in one command
start.sh brings up the API, dashboard, PostgreSQL, Redis, MinIO, Kafka, Grafana and Prometheus.
Kubernetes chart
Helm chart with a pre-upgrade migrate job, secrets from a vault, rolling updates and graceful drain.
Health and metrics
/health, /ready, /live and Prometheus /metrics with Grafana dashboards.
Admin dashboard
A Next.js dashboard for every module, driven by the API’s menu and permissions.
Presets
Pick one per deployment with PROJECT_CODE, or combine presets:ecommerce,collaboration. Only preset names count; anything else is skipped.| PROJECT_CODE | Modules it loads (plus sign-in, workspaces and roles) |
|---|---|
all | every module |
core_only | sign-in, workspaces and roles only |
business | crm, timesheets, invoicing, accounting, kanban, notifications, forms |
tax_copilot | tax_copilot, notifications |
ecommerce | ecommerce, delivery, reviews, shop, notifications, forms |
ecommerce_chat | ecommerce, delivery, chat, reviews, notifications, forms |
collaboration | chat, kanban, vault, services, notifications, forms |
field_service | field_service, ecommerce, timesheets, invoicing, notifications, forms |
property | crm, kanban, invoicing, notifications, forms |
hospital | hospital, notifications, forms |
cms | cms, forms |
academy | academy, forms |
billing | billing, notifications, forms |
services | services |
forms | forms |
ats | ats |
A module that isn't loaded answers 404 for everyone and has no tables. How that works: feature gating technote.