ToolJet

Manage users, workspace memberships and applications through ToolJet’s documented external API, and invoke separately configured workflow webhooks. The external API is an Enterprise self-hosted feature enabled by ENABLE_EXTERNAL_API and EXTERNAL_API_ACCESS_TOKEN; Community or Cloud support is not assumed. The exact configured token is sent as Authorization: Basic <token>, without username/password encoding. Connect with the explicit instance URL, including an HTTP/HTTPS scheme, port and deployment path. Previously stored instance settings remain a validated fallback; conflicting bindings are refused.

Eleven existing tools remain: list_users, get_user, create_user, update_user, update_user_role, list_workspaces, manage_user_workspaces, list_apps, export_app, import_app, and trigger_workflow. Discover resource IDs using the list tools. No current-user identity is inferred from an instance-wide configured token, and dashboard/session routes are not used.

Users support the documented status filter and native creation/read receipts. Creation requires explicit workspace assignments; omitting a password can send an invite. The retained legacy archived creation value is refused with instructions to archive after creation. Workspace replacement requires explicit ADMIN/MEMBER roles and active/archived statuses, encoded as native uppercase values, and group UUIDs. An explicit empty array removes all memberships; omitting it never implies removal. Updates return exact native readable state, distinguish server acknowledgment from unconfirmed roles/passwords, and provide reconciliation guidance after uncertain writes. No atomic compare-and-swap or physical user deletion is promised.

Application exports produce downloadable JSON using the documented POST export endpoint. exportTJDB requests table schemas, not a guaranteed data backup. Export contents may include queries and data-source configuration. The legacy exportData output field remains declared but file contents are delivered as a download. Import acknowledgment contains no exact created-app ID; use list_apps and reconcile app, data-source and database effects before retrying. No undocumented app-delete rollback is attempted.

trigger_workflow retains synchronous execution and adds documented triggerAsync and status actions plus the exact environment query value. Use the workflow’s separate Bearer token and copied webhook identifiers. Asynchronous receipts preserve workflow_execution_id; status returns native state without guessing completion. Timeout does not cancel execution, refund charges or reverse messages/external effects. Routes and execution limits depend on the deployed version and license.

HTTP clients use a 30-second timeout, no redirects and a local 8 MiB JSON request/response/file bound. The unpaginated public user/workspace/app collections have a local 1,000-item safety bound; overflow is refused, never silently sliced. These are integration limits, not claims about provider pagination or capacity. There is no invented OAuth refresh, identity endpoint, signed-file renewal or trigger subscription.

Official references: external API, edition/base URL, users, membership replacement, export, import, workflow webhooks.