API & Webhook Manager Enterprise - Dolibarr
1. Overview API & Webhook Manager Enterprise turns Dolibarr into a complete, professional API Management Platform, fully integrated within the Dolibarr ERP/CRM ecosystem. It lets o rganisations manage, secure, monitor and automate all data exchanges between Dolibarr and external applications (mobile apps, e-commerce sites, marketplaces, third-party CRM/ERP, accounting software and SaaS platforms). It is designed to be comparable to professional platforms such as Postman, SwaggerHub, Kong API Gateway, Apigee, MuleSoft Anypoint, Zapier, Make (Integromat), n8n and Microsoft API Management — while remaining native to Dolibarr, requiring no external tool. 2. Key Features · API Management — REST / SOAP / GraphQL / internal / partner API catalog, versioning, endpoints, automatic API generation from Dolibarr business objects. · Automatic API Documentation — OpenAPI / Swagger documentation generated automatically from the catalog, with OpenAPI 3 JSON export. · Webhooks — Creation, trigger events, payload formats (JSON/XML/CSV), templates, delivery log, retries and HMAC signing secrets. · Connected Applications — Registry of mobile, e-commerce, marketplace, ERP, CRM and accounting applications with environments and IP whitelists. · Security — API keys, tokens (JWT / OAuth 2.0 / Bearer / Refresh), authentication, rate limiting, IP whitelist, security log and audit. · Events & Automation — Business-event library and an event -> condition -> action automation engine. · API Test Center — Built-in Postman-like console (method, URL, headers, body, response). · Real-time Monitoring — Availability, response time, traffic and per-API health supervision. · Logging — Full logging of every API call (date, method, HTTP code, IP, response time). · Integrations & Sync — Synchronisation engine for CRM, ERP, e-commerce, marketplaces and accounting. · Technical Partners, Rate Limits, Payload Templates — Partner directory, quota policies and reusable payload templates. · Modern Dashboard & Reporting — KPI cockpit, HTTP status kanban, DolGraph charts, and a 7-report decisional reporting suite with CSV export. 3. Architecture The module is built on Dolibarr's native CommonObject architecture and follows an object-oriented, field-spec-driven design. Each business object is described by a field specification that generates its SQL schema, its PHP class, and its list/card interfaces through a shared generic engine. 3.1 Components · API Gateway catalog and endpoint registry. · Webhook manager with delivery logging and retry handling. · Event engine and automation rules. · Authentication & security layer (API keys, tokens, rate limiting, IP filtering, audit). · Real-time monitoring and logging subsystem. · Automatic OpenAPI/Swagger documentation generator. · Postman-like test center. · Decisional reporting suite. 3.2 Technical stack · PHP 7.1 to 8.x (validated on PHP 8.1). · MySQL / MariaDB, PostgreSQL compatible. · Dolibarr 16.0+. · Responsive design, self-contained CSS charter (technology blue / cybersecurity black / innovation violet / success green / monitoring orange / error red). 4. Business Objects (16) Object Description api API catalog (hub): type, version, base URL, category, auth, endpoints, calls, availability. endpoint API endpoints (lines of api): path, HTTP method, params, body, response, success code, rate limit. application Connected applications (hub): type, third party, environment, APIs used, IP whitelist. apikey API keys: key, secret, application, scopes, expiration, rate limit, revocation. token Access tokens: JWT/OAuth/Bearer/Refresh, issued/expiry dates, scopes, revocation. webhook Webhooks (hub): target URL, trigger event, payload format, secret, sent/failed counters. webhooklog Webhook deliveries (lines of webhook): event, HTTP code, response time, attempt, delivered. event Business event library: event code, object type, category, subscribers. automation Automation rules: trigger, condition, action type, target, payload template, delay. apilog API call logs: API, application, endpoint, method, HTTP code, IP, size, response time. apitest Saved API tests: API, method, URL, headers, body, expected/last code. integration External integrations (hub): type, direction, sync mode, frequency, records, errors, mapping. partner Technical partners: third party, contact, type, shared APIs, SLA level. ratelimit Rate-limit policies: scope, max per minute/day, monthly quota, action on exceed. secevent Security events: type, source IP, severity, date, resolution. payload Payload templates: format, template body, dynamic variables. 5. Security · Authentication methods: API Key (with rotation), OAuth 2.0 (Authorization Code, Client Credentials), JWT (generation, expiration, refresh), Basic Authentication. · Rate limiting: per user / application / API / global, with block, throttle or notify actions. · IP whitelist / blacklist per application. · HMAC webhook signature secrets. · Security log and audit: authentication failures, blocked IPs, brute force, intrusion detection, quota exceedance. · Permission model: 8 right groups (api, webhook, application, security, event, monitoring, integration, reporting) with read/write/delete, plus an admin right. · GDPR-aware data handling and full action history. 6. Webhooks, Events & Automation The event engine exposes a library of Dolibarr business events (third parties, products, sales, projects, system). Webhooks subscribe to these events and deliver signed payloads to external endpoints; every delivery is logged with its HTTP code, response time and attempt count. The automation engine follows an event -> condition -> action model. Example actions: send a webhook, synchronise a CRM/ERP, notify a manager, call an external API, send an email or log the action. 7. Integrations & Workflow The integration engine synchronises data with external systems (CRM, ERP, e-commerce, marketplaces, accounting) in real time or on a schedule, with configurable direction (inbound / outbound / bidirectional), field mapping, record counters and error tracking. Typical workflow: (1) register an API and its endpoints; (2) generate its OpenAPI/Swagger documentation; (3) issue API keys / tokens to a connected application; (4) subscribe webhooks to business events; (5) automate reactions with rules; (6) monitor traffic, availability and security in real time; (7) analyse usage, performance, errors and SLA in the reporting suite. 8. Dolibarr Integration The module integrates natively with Dolibarr modules — third parties, contacts, products, stock, warehouses, proposals, orders, invoices, contracts, projects, HR, ECM/GED, CRM, agenda and notifications — through hooks, triggers and native REST API/webhook mechanisms. 9. Installation & Demo Data · Copy the apiwebhookmanager/ folder into htdocs/custom/. · Enable the module from Home -> Setup -> Modules. · A realistic demonstration dataset is generated automatically on first activation. · Use API & Webhook Manager -> Setup to configure parameters and to install or remove the demonstration data at will. · Available in French, English, Spanish, Italian and German (native Dolibarr i18n). © 2026 DoliResources — www.doliresources.com — All rights reserved.