Skip to main content
Windmill’s public API lets you read your company’s data programmatically—so you can sync finalized review data into an HRIS, a data warehouse, or your own analytics. It’s a standard REST API that returns JSON, and every route is scoped to a single company.
The API is read-focused and respects the same permissions and visibility rules as the Windmill Dashboard. An API key can only ever see what the person who created it can see.

​
Base URL

Every endpoint is scoped to your company and lives under this base path:
Your company slug is the identifier in your Dashboard URL—https://app.gowindmill.com/{companySlug}/home.

​
Authentication

The API authenticates with API keys. Send your key in the Authorization header using the Bearer scheme:
Every Windmill API key starts with the wm_api_ prefix.

​
Creating an API key

1

Open API key settings

In the Windmill Dashboard, go to Settings → API keys.
2

Create a key

Click Create API key, give it a descriptive name, and optionally set an expiration date.
3

Copy it once

Copy the key and store it somewhere secure—Windmill shows the full key only once and you can’t retrieve it again. If you lose it, revoke it and create a new one.
An API key inherits the permissions of the member who created it. For endpoints that require a specific role—such as being a cycle admin—the person who created the key must hold that role. Treat keys like passwords and revoke any that are no longer needed.

​
Requests and responses

  • Request and response bodies are JSON. Send Content-Type: application/json on any request with a body.
  • Timestamps are ISO 8601 strings (for example 2026-03-31T17:00:00.000Z).
  • Responses include only the fields documented for each endpoint—undeclared fields are stripped, so it’s safe to build on the exact shape you see in the reference.

​
Errors

Errors use standard HTTP status codes. Common ones across the API: