Enterprise API
For companies using Kesk to manage employee spending — mobility, meals, pharmacy, groceries, courier and on-demand services — with policy controls, consolidated billing and reporting.
Root types are EnterpriseQuery and EnterpriseMutation.
Start with Authentication.
What you can do
| Area | Purpose |
|---|---|
The enterprise record itself | |
Invite employees, assign roles, suspend accounts | |
Sync members from Okta, Entra or any SCIM 2.0 provider | |
Sync members from CSV files your HR system uploads | |
Provisioning switches and invoicing currency | |
Allowances and benefits, individually or from templates | |
Plan, usage and invoices — all read-only | |
Dashboard stats, usage summaries, voucher analytics |
A note on scope
The Enterprise API is entirely separate from the Vendor APIs.
It has no profile, products, webhooks or bots — those belong to
businesses selling on Kesk. If you need both sides, you need two clients with
two sets of credentials.
There are no webhooks on the Enterprise API. Integration is request-driven.
Two surfaces here are not GraphQL. SCIM provisioning is a
REST API at enterprise.apis.kesk.app/scim/v2, because SCIM pins its own wire
format and identity providers speak it directly. SFTP data
automation is an SFTP server at sftp.kesk.app, port 2222,
for HR systems that deliver files rather than call APIs.
Getting started
enterprise is the entry point. It
takes no arguments — your token names the enterprise it acts for, and no
operation on this API takes an enterprise ID.
Common questions
Can I create or edit roles through this API?
No. Roles are assigned here but defined by an enterprise administrator outside the API, so a role has to exist before you can reference its id. See Users and roles.
Are there webhooks?
No. Integration with the Enterprise API is request-driven.
Can I change a plan or settle an invoice through the API?
No. Billing is read-only — plan, subscription state, invoices and usage are queries, and there are no billing mutations.
Do I need separate credentials if I also sell on Kesk?
Yes. This API and the Vendor APIs are separate surfaces: two clients, two sets of credentials.
Does any operation take an enterprise ID?
No. Your token names the enterprise it acts for, and every operation resolves the account from it.
Is SCIM part of the GraphQL schema?
No. SCIM provisioning is REST, at
enterprise.apis.kesk.app/scim/v2.
Can I sync employees without SCIM?
Yes. SFTP data automation reads a CSV roster uploaded over SFTP. An enterprise uses SCIM or SFTP, not both.
Reference
Generated reference — every type, field and argument, built from the live schema.