CMiC API
CMiC is a single-database construction ERP powering financials, project management, human capital, and field operations for general contractors, subcontractors, and heavy-civil firms—25% of ENR's top 400 contractors run CMiC. An unofficial API lets you programmatically pull projects, contracts, vendors, invoices, GL documents, work orders, and business partners—and push updates like billings, payments, change orders, and document attachments back into CMiC.
What is CMiC?
CMiC is a construction-focused enterprise resource planning (ERP) platform serving general contractors, subcontractors, and civil/heavy-highway firms. Built on a single-database architecture, CMiC unifies financials, project management, human capital, and field operations so that accounting, project controls, and operations all draw from one source of record. The company reports that 25% of ENR's top 400 contractors run CMiC, managing roughly $100B of construction revenue annually.
Core product areas include:
- Construction Financials (accounting, project controls, equipment/inventory, opportunity management, payroll/HCM)
- Project Management (project controls, drawing/document management, pre-qualification, procurement, quality, safety)
- Workflow (process automation across modules)
- Analytics (data insights and reporting)
- NEXUS (AI-powered construction ERP layer that automates workflows and surfaces data-driven decisions)
Common data entities:
- Projects, Jobs, Job Billing Groups, Project Controls
- Business Partners, Vendors, Subcontractors, Competitors
- Contracts, Change Orders, Purchase Orders, Material Sale Orders
- GL Documents, Vouchers, Invoices, Payments, Pay Deductions
- Work Orders, Assets, Preventative Maintenance records
- Imaging Documents, PM Attachments, ECM/Workflow items
The CMiC Integration Challenge
Contractors run mission-critical workloads on CMiC every day, but turning its module-driven workflows into clean API-driven automation is non-trivial:
- OAuth 2.0 transition and IdP dependency: CMiC is moving from Basic Auth to OAuth 2.0 client-credentials through external identity providers (Azure AD, Okta, Google), so headless integrations must handle JWT tokens, client IDs/secrets, and per-IdP quirks
- Service-account provisioning: API access requires creating and verifying a dedicated CMiC user, plus SSL-certificate validation for integration service accounts before any call succeeds
- Role-based endpoint security: Application-level RBAC restricts each account to specific endpoints, and responses respect company, job, project, and employee security rules—so what you can read varies by role configuration
- Module sprawl: Financials, Project Controls, HCM, Materials, Asset, Opportunity, and ECM/Workflow each expose their own object models and IDs across the open API catalogue
- Single-database coupling: Because financials and operations share one database, writes carry cross-module side effects that must be sequenced carefully to avoid breaking project or GL integrity
- Document and imaging workflows: Drawings, vouchers, PM attachments, and imaging documents need careful upload/download and ECM-aware handling rather than simple field updates
How Supergood Creates CMiC APIs
Supergood reverse-engineers authenticated CMiC sessions and the open API catalogue to deliver a resilient API layer for your CMiC instance—across Financials, Project Management, HCM, Materials, and Asset modules. You integrate once against normalized objects instead of wiring each module's endpoint and security model by hand.
- Handles Basic Auth and OAuth 2.0 client-credentials via Azure AD, Okta, or Google, managing JWT tokens and secrets securely
- Provisions and maintains API service accounts, including SSL-certificate validation and credential rotation
- Normalizes responses across projects, contracts, vendors, GL documents, and work orders so downstream systems rely on consistent objects
- Respects CMiC's role-based and company/job/project-level security so the API only surfaces what your account is entitled to
Use CMiC with AI agents: CMiC MCP Server →
Getting Started
- Schedule Integration Assessment
Book a 30-minute session to confirm your modules, authentication model, and service-account setup.
- Supergood Generates and Validates Your API
We deliver a production-ready CMiC adapter tailored to your instance configuration and role-based entitlements.
- Deploy with Monitoring
Go live with continuous monitoring and automatic adjustments as CMiC evolves.
API Endpoints
Authentication
/authenticateAuthenticate to a CMiC instance using Basic Auth or OAuth 2.0 client-credentials via an external IdP and obtain a token for downstream calls.
Project Management
/projectsList projects and jobs with filters for company, status, project controls, and date range.
Project Management
/create_change_orderCreate a change order against an existing contract with scope, cost, and approval-routing details.
Financials
/invoicesRetrieve invoices, vouchers, and GL documents with status, vendor, and job filters.
Financials
/create_paymentPost a payment or disbursement against a voucher, including pay deductions and GL coding.
Core System
/business_partnersPull business partners, vendors, subcontractors, and competitor records from the Core System module.
Use Cases
Sync project and financial data into a warehouse
- Pull projects, jobs, contracts, and change orders from Project Management into a single warehouse - Stream GL documents, invoices, and payment activity from Construction Financials to BI and reporting tools - Reconcile job-cost and project-control records for unified project profitability views
Automate AP and billing workflows
- Push vendor invoices and vouchers into CMiC and pull approval status back without portal clicks - Match payments, pay deductions, and disbursements against vouchers and GL coding - Surface delinquent or pending billings to AR and cash-flow workflows
Keep vendor and subcontractor data in sync
- Onboard business partners, vendors, and subcontractors and push records to downstream CRM and prequal systems - Pull subcontractor compliance, insurance, and prequalification status for reporting - Trigger procurement and purchase-order workflows when a partner record changes
Connect field and asset operations
- Sync work orders, assets, and preventative-maintenance records with field and EAM tools - Push imaging documents, drawings, and PM attachments into CMiC's ECM/Workflow layer - Route safety, quality, and inspection events to downstream operations dashboards
Technical Specifications
Authentication
Basic Auth or OAuth 2.0 client-credentials via external IdP (Azure AD, Okta, Google) handled in a managed session
Connectivity
Authenticated sessions plus CMiC's open API catalogue across Financials, Project, HCM, Materials, and Asset modules
Response format
Normalized JSON across project, contract, vendor, GL, and work-order objects
Rate limits
Adaptive throttling tuned to your instance to avoid CMiC-side limits and protect shared-database performance
Session management
Automatic JWT/token refresh, service-account verification, and credential rotation
Data freshness
Near real-time pulls for projects, invoices, and work orders with optional scheduled batch syncs
Security
Encrypted credential vault, SSL-certificate validation, RBAC-aware scoping, and audit logging
Webhooks
Event-style callbacks for change orders, invoice approval, payment posting, and work-order status
Latency
Sub-second reads on cached entities; multi-second writes when posting through financial and project workflows
Throughput
Horizontally scaled workers sized to multi-module volume across financials and operations
Reliability
Retry, backoff, and idempotency keys for change orders, payments, and GL transactions
Adaptation
Continuous monitoring of CMiC releases, the OAuth 2.0 migration, and instance-specific configuration drift
Frequently asked questions
Yes. Supergood handles CMiC's legacy Basic Authentication and the newer OAuth 2.0 client-credentials flow through external identity providers like Azure AD, Okta, and Google, managing JWT tokens and secrets for you so the transition is transparent.
Yes. CMiC requires a dedicated, verified API service account with SSL-certificate validation. Supergood provisions and maintains that account against your instance, including verification and credential rotation.
Supergood operates within your configured RBAC roles, so API responses honor company, job, project, and employee security rules. The API only surfaces endpoints and records your service account is entitled to.
The normalized API spans Construction Financials, Project Management, Human Capital Management, Materials Management, Asset Management, Opportunity Management, and ECM/Workflow, so financial and operational entities sit on one surface.
Yes. Because CMiC's single database couples financials and operations, Supergood sequences writes—change orders, payments, GL postings—with idempotency keys and retry logic to preserve project and GL integrity.