LimesWorth Make API

How the integration works

Make uses OAuth 2.0 Authorization Code flow. A customer or reviewer signs in to LimesWorth, selects an eligible Personal or Agency workspace, and grants the review_candidates scope. The selected workspace receives candidates sent through the app.

OAuth endpoints

• Authorize: GET /oauth/make/authorize. Query parameters: response_type=code, client_id, redirect_uri, scope=review_candidates, and state. The redirect URI must be https://www.make.com/oauth/cb/app.
• Token: POST /oauth/make/token with form-encoded data. Client credentials may be sent with HTTP Basic authentication or client_id/client_secret. Authorization-code exchange uses grant_type=authorization_code, code, and redirect_uri. Refresh uses grant_type=refresh_token and refresh_token.
• Current user: GET /oauth/make/me with Authorization: Bearer <access_token>.

Access tokens expire after 1 hour. Refresh tokens expire after 30 days and are rotated on use. Token responses contain access_token, token_type, expires_in, refresh_token, refresh_expires_in, and scope. No raw token is shown again by LimesWorth.

Workspace and entitlement rules

• Personal authorization requires an active Pro plan.
• Agency authorization requires an active Agency entitlement and an eligible Owner or Admin workspace membership.
• The selected Personal and Agency workspaces are isolated; a token can access only its bound workspace.
• The Make connection is created or reused only for the authorized workspace. It does not create a Project or Request.

Create Review Candidate

POST /api/make/v1/review-candidates with Authorization: Bearer <access_token> and Content-Type: application/json.

Required field: sender (non-empty string). Optional fields: event_id, subject, body, thread_id, to, and url. The action creates a Passive Intake review candidate in the authorized workspace. It does not create a Project or Request.

POST https://limesworth.com/api/make/v1/review-candidates
Authorization: Bearer <access_token>
Content-Type: application/json

{"event_id":"make-review-1","sender":"client@example.com","subject":"Review request","body":"Please review this candidate."}

New response: {"ok":true,"duplicate":false,"candidate_id":123,"event_id":"make-review-1","status":"new"}. A replay with the same event_id returns duplicate:true, the existing candidate ID, and status:"existing". Without event_id, the normalized payload is used for idempotency.

Make an API call (Universal module)

Use the existing LimesWorth OAuth connection in Make. Configure the Universal module with method GET and URL /oauth/make/me. Leave user-supplied Headers, Query string, and Body empty for this example.

A successful response is a JSON object containing id, email, name, and workspace. Authentication is handled by the Make OAuth connection; do not paste access tokens or other bearer tokens into the module.

Make App Reviewer — Test Instructions

For Create Review Candidate, inspect the scenario at the scenario editor and run it with synthetic sender data only, such as reviewer-synthetic@example.com. Confirm that the module uses the existing LimesWorth OAuth connection and that the request is sent to the documented candidate endpoint.

For the Universal module, inspect the universal scenario at the scenario editor, run the GET /oauth/make/me example with the existing OAuth connection, and confirm the JSON response contains id, email, name, and workspace.

To inspect the recorded intentional HTTP 400 case, open the API Error scenario and review the existing execution/error record for the invalid sender. Do not repeat the failing request or perform destructive testing.

Use synthetic data only. Never expose OAuth access tokens, refresh tokens, or client secrets in screenshots, logs, scenarios, or review notes.

Errors

• 400 JSON: invalid request, invalid grant, unsupported grant type, missing sender, or a rejected intake payload.
• 401 JSON: invalid client credentials or missing, invalid, expired, or revoked Bearer token.
• 403 JSON: no eligible workspace or invalid workspace selection.
• 415 JSON: the action body is not JSON.

OAuth and API errors are JSON responses; the protected API does not redirect callers to the login page.

Reviewer and customer usage

In Make, connect the LimesWorth app, authorize a permitted workspace, map a sender and any optional fields into Create Review Candidate, and run the module. The resulting candidate is available in LimesWorth Passive Intake for review. Keep the client secret and access/refresh tokens private.