# Flex on the Job

> Inventory, job and invoicing software for businesses that work on the job — HVAC, electrical, plumbing and other trades. Windows desktop that works offline, web app, Android back-office app. One base plan ($99/month, 3 seats, extra seats $29); the REST API, webhooks and MCP server are included on every plan.

The product runs at https://app.flexonthejob.com. This site (flexonthejob.com) is marketing, pricing, help and policy. Machine-readable API material lives on the app host and needs no key to read.

## For developers and agents

- [Developer overview](https://flexonthejob.com/developers): quickstart, keys and permissions, conventions, endpoint map, webhooks, MCP setup, versioning policy
- Nothing is app-only (standing commitment): everything a person can do in the Flex web app is available over the API and MCP — same services back both hosts, and gaps are treated as bugs to close, not a tier to sell. Still web-only for now: calculation authoring, invoice/report PDFs and their emails, password resets, minting API keys
- [API reference (interactive)](https://app.flexonthejob.com/docs)
- [OpenAPI 3 document](https://app.flexonthejob.com/openapi/v1.json)
- [API llms.txt](https://app.flexonthejob.com/llms.txt) and [llms-full.txt](https://app.flexonthejob.com/llms-full.txt): every operation, parameter and schema field in plain text
- Official SDKs (beta): TypeScript `@flexonthejob/api` (npm: https://www.npmjs.com/package/@flexonthejob/api), Python `flex-api` (PyPI: https://pypi.org/project/flex-api/) — thin typed clients over /api/v1 (Bearer auth, idempotency keys, Retry-After, cursor pagination).
- MCP server: `https://app.flexonthejob.com/mcp` (streamable HTTP, `Authorization: Bearer flx_live_…`, 139 tools + 13 prompts + 2 resources; every /api/v1 operation except webhook subscriptions, which are REST/Settings-only by design: the signing secret must not enter an AI transcript and an agent must not be able to create outbound data feeds). Prompts (agent recipes, each confirms before writing): reorder_below_minimum, receive_delivery, cycle_count, restock_vans, invoice_completed_jobs, morning_dispatch_summary, customer_balance_followup, review_pending_transfers, fulfill_ready_sales_orders, stock_valuation_report, end_of_day_summary, onboard_customer, update_costs_from_vendor — [recipes](https://flexonthejob.com/developers#recipes)
- Resources on /api/v1: modules, customers (+ locations CRUD), jobs (+ photos: POST /jobs/{id}/photos upload, multipart/form-data with a file part, JPEG/PNG up to 10 MB; GET /jobs/{id}/photos list; GET /jobs/{id}/photos/{photoId}/content image bytes; DELETE /jobs/{id}/photos/{photoId}), schedule, schedule-groups (+ writes, members, reorder), users (+ create/update/deactivate/reactivate; Organization Admin removal requests at /users/removal-requests), roles (+ create/update/delete custom roles), locations, items (+ stock adjust/move/batch, preferred vendor + part number, custom fields at /items/{id}/properties, units at /items/{id}/units, reorder points at /items/{id}/reorder-points, categories at /items/{id}/categories, /items/low-stock), reorder-points (org-wide list + delete), categories (+ create/update/delete, property definitions), transfers (job-site and standalone: create, submit, pick, per-line pick/unpick/quantity, scan, start, waypoint arrive/deliver/depart/skip, redirect, complete, fail, cancel, approve, reject), vendors, purchase-orders (create to received), sales-orders (create, edit header and lines, fulfill, pick, picked quantity, scan, extra transfers, complete-pick, ship, deliver, complete, cancel, returns), invoices (+ payments, mark-sent, void, DELETE draft), activity (the org's API/MCP request log)
- Keys: per-key permissions, optional expiry (expired → 401) and IPv4/IPv6 CIDR allow-list (other addresses → 403), checked on /api/v1 and /mcp; every request, including the MCP tool name, is readable at `GET /api/v1/activity` or MCP `list_api_activity` (ManageOrganizations), kept 90 days
- Base URL: `https://app.flexonthejob.com/api/v1` — Bearer API key, per-key permissions, 120 req/min per key (adjustable) and 600/min per organization with `X-RateLimit-Limit/-Remaining/-Reset` on every response, cursor pagination, ETags, `Idempotency-Key` required on writes, RFC 7807 errors, list endpoints also in CSV (`Accept: text/csv` or `?format=csv`; next-page cursor in `X-Next-Cursor`)
- [API changelog](https://flexonthejob.com/changelog) (dated, additive-only; [Atom feed](https://flexonthejob.com/changelog.xml)) and [status page](https://status.flexonthejob.com/) (per-service checks every minute, 90-day history, incidents; raw data at https://status.flexonthejob.com/status.json)
- Webhooks: job.created, job.status_changed, job.scheduled, job.assigned, job.completed, invoice.created, invoice.sent, invoice.paid, invoice.deleted, customer.created, transfer.created, transfer.completed, transfer.cancelled, inventory.low_stock, item.updated (also for custom-field and unit-value changes), purchase_order.created, purchase_order.status_changed, sales_order.created, sales_order.status_changed, vendor.created, vendor.updated — `X-Flex-Signature-V2: t=<unix seconds>,v1=<hex>` HMAC-SHA256 of `<t>.<raw body>` (reject t older than 300 s; dedupe on `X-Flex-Delivery`, stable across retries); legacy `X-Flex-Signature: sha256=<hex>` HMAC-SHA256 of the raw body
- Zapier & Make: native apps for both, built on the public webhooks + write API above — 4 instant triggers (job.completed, invoice.paid, inventory.low_stock, customer.created), Create Customer + Create Job actions, Find Customer search. Zapier app in open beta, installable by anyone via its public invite link https://zapier.com/developer/public-invite/246870/e5f37c1f3964d9527128edc98b9dba2a/ (not yet in the Zapier catalog search); Make app on request at developers@flexonthejob.com
- Versioning: /api/v1 is additive-only; breaking changes ship as a new prefix with ≥ 12 months' notice
- Sandbox (no account needed): `https://sandbox.flexonthejob.com/api/v1` and `https://sandbox.flexonthejob.com/mcp` with the public read-only key `flx_live_YLJG6oxA6hOiJTT7ziyAOFs8nJAJfbRE` (View* permissions only, 30 req/min; writes return 403) or the public write key `flx_live_PPZ35t5mlrEPePjZl3yDzQeB7Gweq9GU` (the same reads plus Manage* for inventory, templates, customers, jobs, invoices, transfers, sales orders and purchase orders; 30 req/min). Demo organization (Copperline Heating & Air, a fictional HVAC company), email and webhooks disabled (webhook deliveries are logged as skipped), reset every night at 08:00 UTC. Same OpenAPI/llms.txt/docs are served on that host. Reviewers/auditors can request admin sandbox access (a sandbox admin login + admin-scoped key) privately at developers@flexonthejob.com or security@flexonthejob.com to test admin-gated features (required 2FA, key expiry, IP allow-lists, activity log, exports, user/role writes); no admin key is published.

## Trust

- [Security and trust](https://flexonthejob.com/security): controls in place, what is in place and not (no SOC 2; Sign in with Google SSO on the web app — users and admins, admins always with 2FA, SAML planned; authenticator-app 2FA per user, which an admin can require for the whole organization), sub-processors, data export and deletion, responsible disclosure
- [Data dictionary](https://flexonthejob.com/data-dictionary): every table and column in the organization export (types, keys, enum values, descriptions); machine-readable at https://flexonthejob.com/data-dictionary.json. The export zip (Settings → Export All Data) also runs daily or weekly to SFTP, an S3-compatible bucket or an emailed 7-day link
- [AI posture and roadmap](https://flexonthejob.com/ai): no training on customer data, no model calls unless an organization enables the opt-in AI Assistant, agent acceptable-use, public roadmap and API changelog
- [security.txt](https://flexonthejob.com/.well-known/security.txt)
- [Privacy policy](https://flexonthejob.com/privacy)
- [Terms of service](https://flexonthejob.com/terms)
- [Data Processing Addendum](https://flexonthejob.com/dpa): standard DPA that applies to every account (roles, sub-processors, SCCs, 72-hour breach notice, 90-day deletion); countersigned copy on request

## Product

- [Home](https://flexonthejob.com/): what it does, who it's for, desktop & web, FAQ
- [Pricing](https://flexonthejob.com/pricing): $99/month base plan with 3 seats; $297/quarter or $999/year prepaid earn a $195 onboarding credit; extra seats $29/month; Scheduling add-on $49/month; 30-day free trial, no card
- [Getting started guide](https://flexonthejob.com/help/getting-started)
- [User manual](https://flexonthejob.com/help/manual)
- [Support](https://flexonthejob.com/help/support)

## Contact

- Sales and demos: hello@flexonthejob.com
- Support: support@flexonthejob.com
- Developers and integrations: developers@flexonthejob.com
- Security: security@flexonthejob.com