REST API

An asset management API that is not an enterprise add-on

Every Monkey Assets plan — including the free one — comes with the full REST API and machine check-in keys. JSON in, JSON out, bearer tokens, and no sales call to unlock it.

Start free See pricing

The basics

Base URL: https://monkeyassets.net/api/v1. Every response is JSON: successes are {"ok": true, ...} and failures are {"ok": false, "error": "..."} with a matching HTTP status code.

Included on every plan The API and machine-intake keys are not gated behind a higher tier — the free plan can call everything.
Bearer tokens, never cookies The API never reads a session cookie, which makes it immune to CSRF by construction.
Scoped to your organisation A token only ever sees its own organisation, and only what that user's role and site purview allow.
Anything unknown returns 404 An id outside your organisation is indistinguishable from one that does not exist, so the API can never be used to probe what other customers hold.

Authentication

Swap credentials for a token, then send it as an Authorization: Bearer header. Tokens are revocable per device from My account, die on password change, and expire after 90 days unused.

Method	Endpoint	What it does
`POST`	`/auth/login`	Exchange {email, password, device_name} for a bearer token.
`POST`	`/auth/pair`	Redeem a one-time pairing code from My account — no credentials typed on the device.
`GET`	`/auth/methods`	Which sign-in methods this instance offers (password, Microsoft SSO).
`POST`	`/auth/logout`	Revoke the token you presented.

Assets

The core of the register. Creates and edits obey the same roles as the web app: admin and manager can write, viewers are read-only and see only their own purview.

Method	Endpoint	What it does
`GET`	`/assets`	List assets. Filter with q, status, type; paginate with limit (max 500) and after_id.
`POST`	`/assets`	Create an asset. Returns it with its freshly minted QR tag.
`GET`	`/assets/{id}`	One asset in full, with its spec and file metadata.
`PATCH`	`/assets/{id}`	Partial update — send only the fields you are changing.
`DELETE`	`/assets/{id}`	Soft-delete (admin only). The tag stays reserved forever.
`GET`	`/assets/lookup`	Resolve a scanned QR tag: ?tag=ACME-0006.
`GET`	`/assets/match`	Is this machine already registered? ?serial_number=&computer_name=
`GET`	`/meta`	The form vocabularies — statuses, types, sites, users, scoring bands.
`GET`	`/sites`	Your sites.
`GET`	`/users`	Your people (admin and manager only).
`GET`	`/me`	The authenticated user and their organisation.

Files, labels and QR codes

Photos, receipts and spec sheets attach to the asset they belong to, and every asset can hand you its QR label as a PNG.

Method	Endpoint	What it does
`GET`	`/assets/{id}/files`	List a given asset's attachments.
`POST`	`/assets/{id}/files`	Upload multipart or base64 JSON (10 MB decoded cap).
`GET`	`/files/{id}`	Download one. Images and PDFs inline, everything else as an attachment.
`DELETE`	`/files/{id}`	Delete one (admin and manager).
`GET`	`/assets/{id}/qr.png`	The asset's QR label as a PNG, ready to print.

Automatic machine check-in

The one endpoint that does not need a user. Mint an intake key in Settings, drop it into your own script or deployment tooling, and every machine it runs on files itself as an asset — matched by serial then name, so nothing is entered twice.

Method	Endpoint	What it does
`POST`	`/intake`	Register or update a machine. Authenticate with an X-Api-Key header, not a bearer token.
`POST`	`/ai/extract`	Run an AI scan over device photos and get the make, model and serial back.

Keeping your own copy in sync

GET /assets accepts updated_since, and the sync path is built to survive rows changing underneath you mid-pagination — which is the part most APIs get quietly wrong.

Deletions are included A sync response carries tombstones for soft-deleted assets, so your copy learns about removals instead of silently keeping ghosts.
A stable cursor Pages order by updated_at and id together, with a compound cursor, so a row edited mid-pagination re-enters a later page rather than being skipped.
Stamp the watermark first server_time is taken BEFORE the query runs. Store the last page's server_time as your next updated_since; the worst case is a harmless re-delivery.
Page with after_id Full listings paginate with limit (up to 500) and after_id, ordered by id.

Common questions

Is the API really included on the free plan?

Yes. The REST API and machine-intake keys are on every plan, including Free. The plans differ by how many assets, AI scans, users and storage you get — not by which endpoints you are allowed to call.

How do I authenticate?

Two ways, depending on what is calling. A person or an app uses POST /auth/login (or a pairing code) to get a bearer token and sends it as an Authorization header. Automated machine check-in uses an org intake key in an X-Api-Key header instead, so you never put a user's credentials on a fleet of machines.

Does the API send my data outside Australia?

Two AI paths do, plus your own Microsoft tenant if your integration uses it. POST /ai/extract sends the photos you give it to our AI provider to read the make, model and serial, and performance scoring does the same with the specs a machine reports on its first check-in or when an asset is re-scored — unless an admin has switched performance scoring off for the organisation, in which case a check-in still registers the machine and returns its tag and QR, and sends no specifications at all. Signing in through Microsoft or importing from Intune talks to your own tenant. Every other endpoint is served from, and stays in, Australia — see our data-sovereignty page for the full list.

How will I know if the terms have changed?

Every authenticated response carries an X-Terms-Update-Required header naming the current version whenever your organisation has not accepted it yet, and GET /meta reports the same thing as terms_version and terms_current. Nothing is blocked while you are behind — we would rather your machines kept registering than have a fleet stop checking in because nobody had signed into the web app that week. Accepting is a web action: an administrator does it once, on behalf of the organisation, next time they sign in.

Is there a rate limit?

There are no published per-endpoint quotas. Authentication attempts and intake-key failures are throttled per IP to make brute force impractical, so back off rather than retrying a failed login in a tight loop. If you are planning something high-volume, talk to us first.

Can I use it to register machines automatically?

Yes — that is exactly what POST /intake is for. Drop an intake key into your imaging, RMM or deployment tooling and machines file themselves, printable QR label and all. The bundled Windows and Mac uploader is just a client for this same endpoint.

Is this the complete endpoint list?

It is everything you would integrate against. A few endpoints used only by our own desktop uploader and mobile sign-in flow are left out because they are client internals rather than a stable integration surface. The in-app reference under Settings, Apps and API is the authoritative one for your organisation.

Keep reading

Where your data lives → Intune asset management → Pricing →