API & developers

The entire vault is operated via code. Without touching the core.

Full REST API, 28+ HMAC-signed webhooks, native WordPress hooks, and zero-config Fluent integrations. If you have an IT team, they can hook up your stack in a single afternoon.

Anti-SSRF

HMAC SHA-256 signature

AES-256-CBC at rest

Timestamped audit trail

Mandatory TLS 1.3

Anti-tamper plugin

Read full documentation

Book a CTO call

On this page

01 · REST API

02 · Webhooks

03 · WordPress Hooks

04 · Security & audit

05 · Fluent Integrations

06 · Resources

Complete REST API

Everything can be exposed via REST — clients, files, cards, links, embeds, tags, workflows, certificates, audit. Auth via API key, granular ACLs, and call logs.

Client endpoints

GET /wp-json/cv/v1/clients
POST /wp-json/cv/v1/clients
PUT /wp-json/cv/v1/clients/{id}
DEL /wp-json/cv/v1/clients/{id}

File endpoints

POST /cv/v1/files/upload
GET /cv/v1/files/{id}/token
POST /cv/v1/files/{id}/archive
POST /cv/v1/files/{id}/expiry

Cards / Links / Embeds endpoints

GET /cv/v1/cards
POST /cv/v1/links
POST /cv/v1/embeds
GET /cv/v1/tags

Cross-functional endpoints

GET /cv/v1/search
GET /cv/v1/audit
GET /cv/v1/parcours
GET /cv/v1/certificates

Example: retrieve the client list

curl -X GET https://votre-site.fr/wp-json/cv/v1/clients 
  -H "Authorization: Bearer YOUR_API_KEY" 
  -H "Accept: application/json"

# JSON response:
# {
#   "data": [
#     {"id": 12, "name": "Mr. Bertrand", "email": "...", "tier": 1},
#     {"id": 13, "name": "SCI Verdun", "email": "...", "tier": 2}
#   ],
#   "meta": { "total": 124, "page": 1, "per_page": 20 }
# }

Authentication & logging : API keys per user (WP Roles), ACL per endpoint, comprehensive call logs (method, URL, IP, operator, duration). Configurable quotas and rate-limits.

Webhooks (28+ events)

Every significant action triggers an HMAC-signed POST to your endpoints. Multi-target, independent secrets, anti-SSRF, exponential retry.

Vault & documents

file.uploaded
file.validated
file.refused
file.expired
file.archived
file.signed

Clients & auth

client.created
client.archived
client.tagged
client.login
client.logout
client.password_reset

Workflows & gates

parcours.enrolled
step.unlocked
step.completed
quiz.submitted
certificate.issued
parcours.finished

Community & engagement

comment.posted
announcement.published
trophy.unlocked
event.created
event.rsvp
replay.viewed

Example: payload + HMAC signature

POST https://votre-stack.fr/webhooks/cv-receiver
Headers:
  X-CV-Event: file.validated
  X-CV-Signature: sha256=8b1cde…
  Content-Type: application/json

{
  "event": "file.validated",
  "occurred_at": "2026-05-02T10:34:21.842Z",
  "data": {
    "file_id": 4521,
    "client_id": 12,
    "operator_id": 3,
    "name": "Bilan 2024 SARL VERDIA.pdf",
    "audit_url": "https://votre-site.fr/cv/audit/4521"
  }
}

# Verify signature on receiver side:
# computed = "sha256=" + hmac_sha256(secret, raw_body)
# hmac.compare_digest(computed, header) → true

Configuration: multiple target URLs, each with its own secret. SSRF filtering (RFC 1918, link-local). Exponential retry up to 24h. Delivery logs.

Native WordPress Hooks

Client Vault is a WordPress plugin — the entire chain is extensible via add_action / add_filter without modifying the core. Compatible with your existing code and custom plugins.

Main actions

cv_after_file_uploaded
cv_after_file_validated
cv_after_step_completed
cv_after_client_created
cv_after_audit_log

Main filters

cv_email_subject
cv_email_body
cv_max_upload_size
cv_storage_quota_gb
cv_token_lifetime

Capabilities & roles

cv_user_can_view_client
cv_user_can_validate
cv_user_can_export
cv_user_capabilities_map

Example: send a Slack notification after validation

add_action( 'cv_after_file_validated', function ( $file_id, $client_id, $operator_id ) {
    $file   = cv_get_file( $file_id );
    $client = cv_get_client( $client_id );

    wp_remote_post( 'https://hooks.slack.com/services/T0…', [
        'headers' => [ 'Content-Type' => 'application/json' ],
        'body'    => wp_json_encode( [
            'text' => sprintf(
                '✅ %s validated "%s" for %s',
                wp_get_user( $operator_id )->display_name,
                $file->name,
                $client->name
            ),
        ] ),
    ] );
}, 10, 3 );

Security & audit

If your CISO / DPO conducts an audit, these are the points they will examine. Everything is documented, configurable, and logged.

AES-256-CBC Encryption

Key per client area, unique IV per file, encryption at rest on disk. The master key resides in wp-config.php, never in the database.

Anti-SSRF (webhooks)

Blocks outgoing webhooks to internal networks (RFC 1918), localhost, link-local, private IPv6, and cloud metadata (169.254.x.x). Optional allowlist available.

Anti-tamper plugin

Hash of key files verified at plugin boot. If a critical file has been modified (potential compromise), the plugin refuses to start in sensitive mode.

Complete timestamped audit

Every API call, UI action, and webhook sent is logged: operator, IP, method, target, duration, and status. Provides legally admissible PDF or CSV exports.

Admin IP filtering

Restrict admin access to a specific set of IPs / CIDRs (office, VPN, remote work). IPv4 and IPv6 compatible.

GDPR: export & deletion

Selective client data export (JSON/ZIP), one-click right to be forgotten, and configurable retention periods by data category.

Native Fluent integrations

For the Fluent stack, it is zero-config. Client Vault detects the plugin’s presence and activates the gateway.

FluentCRM

Auto-tagging of contacts based on vault events, sequences triggered by journey steps, and dynamic segments.

FluentPlayer

Integrated video player for vault replays / media files, with viewing tracking per client.

FluentCart

Stripe payments integrated into client journeys: a “payment” step automatically validates upon receipt of the Stripe webhook.

Fluent Community

Mapping N × N journeys / spaces, 21 contextualized widgets, multi-source search, ranking and trophies.

Beyond Fluent: everything else goes through webhooks or the REST API. Direct Stripe, Calendly, Cal.com, Zapier, n8n, Make, your custom CRM — no limits.

Developer resources

Full documentation, ready-to-use collections, and a support channel.

Full documentation

Endpoints, payloads, examples, error codes, rate-limits, changelog.

docs.clientvault.app →

Postman collection

All endpoints pre-configured, dev/staging/prod environments, payload examples.

Download

OpenAPI / Swagger

YAML / JSON specification to generate your clients in TypeScript, Python, Go, etc.

View the spec

Developer community

Private space for integrators: examples, use cases, and feedback on useful hooks.

Join

Ready to connect your stack?
We will show you via video call.

30-minute CTO demo: we take your stack, list the connection points, and answer your security/GDPR questions live.

Book a CTO demo

Read full documentation

View all features

The entire vault is operated via code. Without touching the core.

Complete REST API

Client endpoints

File endpoints

Cards / Links / Embeds endpoints

Cross-functional endpoints

Example: retrieve the client list

Webhooks (28+ events)

Vault & documents

Clients & auth

Workflows & gates

Community & engagement

Example: payload + HMAC signature

Native WordPress Hooks

Main actions

Main filters

Capabilities & roles

Example: send a Slack notification after validation

Security & audit

AES-256-CBC Encryption

Anti-SSRF (webhooks)

Anti-tamper plugin

Complete timestamped audit

Admin IP filtering

GDPR: export & deletion

Native Fluent integrations

FluentCRM

FluentPlayer

FluentCart

Fluent Community

Developer resources

Full documentation

Postman collection

OpenAPI / Swagger

Developer community

Ready to connect your stack?We will show you via video call.

Ready to connect your stack?
We will show you via video call.