Agentic Fabriq
Raisely
BUSINESS · COMMERCE & FINANCE
Campaigns, fundraising profiles, donations, and supporters for their org.
Connecting Raisely in practice
Raisely verifies a webhook by handing your endpoint the shared secret twice — once as an Authorization: Bearer header and again as a secret field inside the JSON body — so there is nothing to compute and the secret travels in every payload. A failing endpoint is retried 4 more times, an hour apart, and then disabled altogether.
Scopes that draw scrutiny
Campaign API keyRaisely’s own alternative to an admin login for server-to-server calls. It can register users, create fundraising profiles and mint access tokens for other users in the organisation.ORG_ADMIN roleRequired, alongside or instead of a campaign API key, to generate short-lived access tokens for other users — including in bulk for up to 1,000 of them at once.Bearer token rolesThe roles on a token may be a subset of the roles the user holds, so /authenticate is the only way to learn what a token can actually do.
Who has to approve
Minting access tokens on behalf of other people is gated on the provider side: both the single and the batch access-token endpoints require authenticated ORG_ADMIN or campaign API-key access for the target user’s organisation, and they work only for active non-admin users.
Worth knowing
- Access tokens expire on the organisation’s configured policy, 48 hours by default, so a long-running agent has to re-issue rather than cache indefinitely.
- POST /users/accessTokens/batch covers up to 1,000 users per request and always stamps context as public_api_bulk; a caller may not supply its own context.
- Call /authenticate to discover the organisationUuid your token belongs to — it is not in the token and several endpoints need it, participant login among them.
- Webhooks default to firing for every campaign in the account; restricting one to a single campaign means passing campaignUuid when you create it.
- The docs document a 429 for too many requests but publish no threshold, so back-off has to be adaptive rather than budgeted.
Checked against About webhooks (2026-09-29), Authenticate a token (2026-09-29), Access tokens batch (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Raisely behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.