How do I authenticate?

Sign in with POST /login as a named user to get a bearer access token (12 hours or less) and a refresh token that rotates on every use. There are no long-lived API keys yet. Create a dedicated integration user instead.

Do you have native connectors for SAP, NetSuite, QuickBooks or ServiceNow?

No. We don’t claim connectors we haven’t built. These systems connect through the Asetavo REST API, webhooks and CSV, built by your team or a partner.

Which events can trigger webhooks?

Alert rules: left zone, entered zone, unregistered tag and exit without an active check-out. Each delivery is signed with X-Asetavo-Signature (HMAC-SHA256 of the raw body) and carries X-Asetavo-Event: asset_manager.alert.

Can I import data from spreadsheets?

Yes. The import wizard takes Excel (.xlsx) or CSV files, maps your columns and creates the assets. Through the API you can also create records programmatically.

What exports are available?

Excel (.xlsx) and CSV for the asset register and reports on every plan, and JSON for every report through the API.

Integrations & API

Connect Asetavo to the systems you already use

Asetavo does not replace your ERP, ledger or service desk. It feeds them and listens to them. On the Business plan and above, each workspace has a REST API for reading and writing assets, movements and reports, webhooks that push alert events as they happen, and a signed ingest endpoint for fixed RFID readers. Excel and CSV exports for the register and reports come with every plan.

Business and aboveCompare plans

Connect Asetavo to your systems Book a demo

Integration architecture

Northfield Group workspace

Every connection goes through the Asetavo REST API, webhooks, CSV or signed reader ingest

Your systems

ERP

Asset master, cost centres

API

Accounting / GL

NBV, depreciation, disposals

API · CSV

HR / HRIS

Joiners, leavers, custodians

API

Procurement

New purchases → new assets

API

IT service desk

Laptops, tickets, hand-overs

API · webhook

Security / SOC

Zone-exit alerts

Webhook

Data warehouse / BI

API · CSV

Fixed RFID readers

Tag reads at doors & docks

Signed ingest

Identity provider (SSO)

Single sign-on

Coming soon

How they connect

REST APIin / out

JSON over HTTPS · bearer token · read & write

Webhooksout

Alert-rule events · HMAC-signed

CSV exportout

Asset register · stock-take variance

Reader ingestin

HMAC-signed event batches

Asetavo

Permission check on every call

Asset register

Locations & custodians

Movements & check-outs

Stock-takes

Work orders

Depreciation

Readers, zones & alerts

Separate database per company

No native connectors: integrations are built on the API by your team or a partner

Product screen · sample data

What it solves

What changes when integrations & api moves into Asetavo

The way it usually works today, and the way it works once it lives in one system.

Before: New assets are typed into the ERP by procurement and again into the asset list by operations, and the two never match.
With Asetavo: Your procurement or ERP job creates the asset through POST /assets once, and both systems share the same tag number from day one.
Before: Finance rebuilds the NBV figures every month from exported spreadsheets.
With Asetavo: Your ledger integration pulls the register, depreciation runs and per-asset schedules from the API, or finance downloads the register as Excel or CSV.
Before: Security hears about a forklift leaving the depot the next morning.
With Asetavo: An alert rule with a webhook pushes a signed “left zone” event to your security system or service desk seconds after the reader sees it.
Before: Fixed readers write into a black box that anyone on the network could spoof.
With Asetavo: Readers sign every batch with their own secret. Asetavo rejects anything unsigned, stale, replayed or oversized.

Product in action

What your team actually sees

Coded from the real Asetavo screens, with sample data for a fictional company, Northfield Group.

Sign in, list assets, record a movement and export the register, the same calls documented on the developer pages. The base URL is your workspace’s own API host.

1 · Sign in2 · List assets3 · Record a movement4 · Export register

POST/login→ bearer access token (≤12 h) + rotating refresh

BASE="https://app.asetavo.com/api/w/<your-workspace>"

curl -s -X POST "$BASE/login" \
  -H "Content-Type: application/json" \
  -d '{"email":"erp-sync@northfield.example","password":"••••••••","label":"ERP sync"}'

{ "success": true, "message": "Login successful",
  "data": { "access": "eyJhbGciOiJIUzI1NiIs…", "refresh": "8f3c1e…",
            "token_type": "Bearer", "expires_in": 43200, "device_uuid": "2b7f…" } }

GET/assetsneeds view · per_page ≤ 200

curl -s "$BASE/assets?q=forklift&per_page=50" \
  -H "Authorization: Bearer $ACCESS"

{ "success": true, "message": "OK",
  "data": [ { "id": 118, "tag_no": "NF-00118", "name": "Electric forklift 2.5 t", … } ],
  "meta": { "page": 1, "per_page": 50, "total": 64, "total_pages": 2 } }

POST/movementsneeds edit

curl -s -X POST "$BASE/movements" \
  -H "Authorization: Bearer $ACCESS" -H "Content-Type: application/json" \
  -d '{"asset_id":118,"to_location_id":42,"reason":"Transfer to Denver","ref":"TRF-0091"}'

GET/export/register.csvneeds view

curl -s "$BASE/export/register.csv" \
  -H "Authorization: Bearer $ACCESS" -o register.csv

Every response uses one envelope: { success, message, data, meta? }. Errors return success: false with an HTTP status.

REST API in four calls

1
POST /login
Returns access and refresh tokens. Send the access token as Authorization: Bearer on every call.
2
GET /assets
Filter by text, category, location, status or custodian. Paginated, up to 200 per page.
3
POST /movements
Updates the asset’s location or custodian and appends to its history, attributed to the integration user.
4
One envelope
Every response has the form { success, message, data, meta? }, so error handling is the same everywhere.

Sample data

POSTDelivered by Asetavo when the rule fires · HTTPS only · no redirects · short timeout, up to 3 attempts

POST https://erp.northfield.example/hooks/asetavo
Content-Type: application/json
X-Asetavo-Event: asset_manager.alert
X-Asetavo-Signature: 3b9e0f…c41d   (hex HMAC-SHA256 of the raw body)

{ "alert_id": 311, "rule_id": 4,
  "rule_name": "Forklifts stay inside Dallas DC",
  "condition": "left_zone", "type": "left_zone",
  "asset_id": 118, "asset_tag": "NF-00118",
  "reader_id": 3, "zone_id": 2, "event_id": 90211,
  "direction": "out",
  "observed_at": "2026-09-28 14:02:11",
  "fired_at": "2026-09-28 14:02:12" }

NodeVerify the signature before you trust the payload

import crypto from 'node:crypto';

app.post('/hooks/asetavo', express.raw({ type: 'application/json' }), (req, res) => {
  const expected = crypto.createHmac('sha256', process.env.ASETAVO_WEBHOOK_SECRET)
    .update(req.body).digest('hex');              // raw bytes, not re-serialised JSON
  const given = String(req.get('X-Asetavo-Signature') || '');
  const ok = given.length === expected.length &&
    crypto.timingSafeEqual(Buffer.from(given), Buffer.from(expected));
  if (!ok) return res.sendStatus(401);
  queue.push(JSON.parse(req.body));                // respond fast, process later
  res.sendStatus(204);
});

Webhook delivery and verification

1
Headers
X-Asetavo-Event: asset_manager.alert and X-Asetavo-Signature: hex HMAC-SHA256 of the raw body, using the rule’s secret.
2
Payload
Alert, rule, condition, asset id and tag, reader, zone, event id, direction, observed and fired timestamps.
3
Verify on raw bytes
Compute the HMAC over the raw request body and compare in constant time. Re-serialised JSON will not match.

Sample data

Capabilities

Everything in Integrations & API

Every card below is in the product today, on the plans shown above.

REST API

JSON over HTTPS for assets, locations, tags, movements, check-outs, stock-takes, work orders, contracts, depreciation, readers, zones, alerts and reports.

Bearer-token auth

Sign in as a named user. Access tokens last 12 hours or less, refresh tokens rotate, and each integration is a revocable device session.

Permission-scoped

The API enforces the same nine permissions as the app, deny-by-default. Finance fields need finance.

Signed webhooks

Alert rules can POST to your HTTPS endpoint, signed with HMAC-SHA256 and retried up to 3 times with backoff.

Excel and CSV export

The asset register and reports as .xlsx or CSV on every plan; CSV is safe against formula injection.

Signed reader ingest

Fixed readers post HMAC-signed event batches with a timestamp and nonce. Up to 500 events or 256 KB per request, 600 events a minute per reader.

Excel & CSV import

Upload your existing register, map the columns, review problem rows and import — missing categories, locations and custodians are created for you.

Offline-safe app writes

Changes made in the Asetavo app without signal wait on the phone, each with its own client id, and sync exactly once through the same API. The Sync centre shows what is waiting.

Not in the product yet

Everything else on this page is live today. These are the pieces we are still building.

Coming soonSingle sign-on (SSO)
RoadmapLong-lived API keys and more webhook event types
RoadmapNative accounting / ERP connectors

In the Asetavo app

From the phone into your other systems

Field changes made offline sync exactly once, so the REST API and your exports always see one clean record per action. From the phone, export any report to Excel or CSV and share it.

Coming soon on theApp StoreComing soon onGoogle Play

Tour the app Mobile app features

Sync centre showing All synced, with Sync now and Export log (sample data) — Real screens from the Asetavo phone app (demo workspace, fictional company). iOS and Android apps coming soon to the App Store and Google Play.

Export sheet choosing Excel or CSV and grouped columns (sample data) — Real screens from the Asetavo phone app (demo workspace, fictional company). iOS and Android apps coming soon to the App Store and Google Play.

How it works

From first step to everyday use

01
Create an integration user
Add a named user (for example “ERP sync”) and give it only the permissions it needs, such as view and create.
02
Sign in for a token
POST /login with that user’s email and password returns a bearer access token (12 hours or less) and a rotating refresh token.
03
Read and write
Call /assets, /movements, /checkouts, /work-orders, /reports and more on your workspace’s base URL. Every call is checked against the user’s permissions.
04
Subscribe to events
Create an alert rule with the webhook channel. Asetavo POSTs a signed JSON payload to your HTTPS endpoint when the rule fires.
05
Export in bulk
Download the asset register or a report as Excel or CSV by hand, or the CSV from a script, for BI tools and ledgers.
06
Connect hardware
Fixed RFID readers send HMAC-signed event batches to /ingest/events using their own per-reader secret.

Workflows, end to end

ERP creates the asset

A purchase order for 20 laptops is received in the ERP.
The ERP job signs in as “ERP sync” (view and create) and POSTs each laptop to /assets.
Asetavo returns each new asset record, and the ERP stores its id and tag number against the PO line.
IT prints labels and tags the laptops. From then on both systems refer to the same NF- numbers.

Zone-exit alert to the service desk

Security creates an alert rule: forklifts, left zone Dallas DC, channel webhook.
A portal reader signs and sends the read. Asetavo resolves the tag and the rule fires.
Your endpoint receives the payload, verifies X-Asetavo-Signature, and opens a ticket.
The on-call officer acknowledges the alert in Asetavo, which records who and when.

Monthly NBV into the ledger

Finance posts the month’s book depreciation run in Asetavo.
A scheduled script pulls GET /depreciation/runs and the run detail.
It builds the journal and posts it to your accounting system.
The register CSV is saved as supporting evidence for the close.

Compare

Integration methods compared

Criteria	REST API	Webhooks	Excel / CSV export	Reader ingest
Direction	Read and write	Asetavo → you	Asetavo → you	Reader → Asetavo
Trigger	Your code calls it	An alert rule fires	Download or script	Tag reads at a reader
Auth	User bearer token	HMAC signature you verify	User bearer token	Per-reader HMAC secret
Best for	ERP, HR, ITSM, BI sync	Security and service-desk alerts	Ledgers, audits, one-off analysis	Doors, docks and gates
Data	Almost every object	Alert events	Register, stock-take variance	EPC or code, direction, RSSI
Import	POST per record	—	Excel / CSV import wizard	—

Spreadsheet import is self-serve through the Excel/CSV import wizard — no ticket to our team needed.

Deep dive

The detail behind it

What you can connect, and how

Every category connects through the Asetavo API, webhooks or CSV. There are no pre-built connectors to claim.

ERP: Create assets from purchase orders (POST /assets), keep tag numbers in sync, and read the register back (GET /assets).
Accounting / GL: Pull depreciation runs and per-asset schedules (GET /depreciation/runs, /assets/{id}/depreciation), or download the register CSV for NBV.
HR / HRIS: Maintain custodians and departments (/custodians, /departments), and list what a leaver still holds (GET /reports/by-custodian).
IT service desk (ITSM): Look up a laptop by tag (GET /assets/lookup), open work orders (POST /work-orders), and receive alert webhooks as tickets.
IoT and RFID: Fixed readers post signed events to /ingest/events. Handhelds and phones use the mobile app or the stock-take scan API.
Data warehouse / BI: Schedule your own job to pull /reports/* and /assets, or load the register CSV.

Conventions and limits

Useful to know before you write the first line of integration code:

Base URL: Each workspace has its own API base: https://app.asetavo.com/api/w/<your-workspace>, where <your-workspace> is your workspace name.
Envelope: Every response is { success, message, data, meta? }. Lists include page, per_page, total and total_pages in meta.
Paging: per_page defaults to 25, maximum 200.
Throttling: Repeated failed sign-ins return HTTP 429 with a growing lock-out. Reader ingest above 600 events a minute returns 429.
Webhook delivery: HTTPS only, no redirects, short timeouts, up to 3 attempts with exponential backoff. Respond quickly with a 2xx and process asynchronously.
No SDKs: There are no official client libraries yet. The examples use curl, Node and Python.

Works with

Connected to the rest of Asetavo

Security & PermissionsThe API uses the same permissions, sessions and audit trail.AlertsWebhooks are a channel on alert rules.RFID Readers & PortalsFixed readers connect through signed ingest.ReportsEvery report is available as JSON and the register as CSV.DepreciationPull runs and schedules into your ledger.

Who uses it

Integrations & API by industry

IT teamsConnect the service desk and HR system so laptops follow joiners, movers and leavers.LogisticsPortal readers at docks feeding zone alerts into security and dispatch systems.ManufacturingERP-created assets, with work orders and downtime pulled into plant reporting.HealthcareEquipment register synced with procurement and biomedical engineering tools.GovernmentRegister and variance exports for finance systems and auditors.

Go deeper

DevelopersDeveloper overview DevelopersAPI reference HelpIntegrations help GuideComplete guide to RFID asset tracking GuideImplementing asset management software ArticleMoving from Excel to asset management software

FAQ

Integrations & API questions

Want to see it with your assets?

Walk us through your sites and we’ll show you integrations & api set up the way you’d use it.

Book a demo

Yes, on the Business plan and above. Each workspace on those plans has a REST API that covers assets, locations, tags, movements, check-outs, stock-takes, work orders, contracts, depreciation, readers, zones, alerts and reports, with JSON responses in one standard envelope.

Make Asetavo part of your stack

Start with the API reference, then connect your ERP, ledger, service desk or readers through the same secure endpoints the app uses.