An API (application programming interface) is a published contract that lets one program use another: which requests it may send, what it gets back, and the rules for authentication and errors. People use an application through its screens; other software uses it through its API.
Most business software today offers a web API, and most web APIs follow the REST style. A REST API exposes data as resources at URLs, such as /assets, /assets/118 or /locations, and clients act on them with standard HTTP methods, exchanging data as JSON. An asset management API is simply a REST API over an asset register: assets, tags, locations, movements, check-outs and work orders.
How a REST API request works
- Authenticate. The client obtains a credential, such as an access token, and sends it with each request.
- Send the request: a method, a URL, headers and, for writes, a JSON body.
- The server checks the credential and the caller’s permissions, then validates the input.
- The server responds with an HTTP status code and a JSON body.
- The client handles the result, including errors, pagination and rate limits.
HTTP methods in a REST API
| Method | What it does | Example | Safe to repeat? |
|---|---|---|---|
| GET | Read a resource or a list | GET /assets?q=laptop | Yes |
| POST | Create a record or trigger an action | POST /movements | Not by default |
| PUT | Update or replace a record | PUT /assets/118 | Yes |
| PATCH | Change part of a record | PATCH /assets/118 | Depends on the API |
| DELETE | Remove a record | DELETE /tags/55 | Yes |
Status codes you will see
- 200, 201, 204: it worked.
- 400 Bad Request: the input was invalid; fix it, do not retry unchanged.
- 401 Unauthorized: missing or expired credential; refresh the token and try again.
- 403 Forbidden: signed in, but the account lacks permission.
- 429 Too Many Requests: you hit a rate limit; wait and retry.
- 5xx: a server problem; retry later with backoff.
Authentication: API keys vs tokens
| Method | How it works | Trade-off |
|---|---|---|
| API key | A long-lived secret string sent with each request | Simple, but must be stored, rotated and revoked carefully |
| Bearer access token | A short-lived token, often a JWT, obtained by signing in and sent as “Authorization: Bearer …” | Expires on its own; needs a refresh step |
| OAuth 2.0 | A user grants a third-party app delegated access | Best for apps built by other companies |
Whichever method an API uses, run integrations under a dedicated account with only the permissions they need (see RBAC), keep secrets out of source code, and revoke access when the integration is retired.
Rate limits and pagination
APIs limit how fast a client can ask. Exceed a rate limit and the server returns 429; wait and retry with growing gaps. Long lists come back in pages (for example page and per_page), and a sync must loop to the last page or it will miss records.
Example request (illustrative)
Common asset management integrations
| System | What flows | Typical method |
|---|---|---|
| ERP and accounting | New assets from purchasing; cost, depreciation and disposals to the ledger | API and CSV |
| HR | Starters and leavers as custodians; assets held by a leaver | API |
| IT service desk (ITSM) | Look up a device by tag, raise work orders, tickets from alerts | API and webhooks |
| Security operations | Movement and zone alerts as they happen | Webhooks |
Common mistakes
- Using a personal admin account for an integration.
- Ignoring token expiry, so the sync fails overnight with 401 errors.
- Reading only the first page of results.
- Retrying POST blindly, which can create duplicate records.
Spreadsheet exports vs an API
Without an API, systems are connected by hand: export a CSV, reshape it in Excel and import it elsewhere. That works monthly. It breaks down when data must move daily, the person who does it is away, or copies drift apart. An API lets a scheduled job do the work reliably.
The Asetavo API
On the Business plan, each Asetavo workspace has a REST API covering assets, locations, movements, check-outs, tags, stock-takes, maintenance, depreciation and reports. An integration user signs in to receive a short-lived Bearer access token and a rotating refresh token, tied to a device session you can revoke; long-lived API keys are on the roadmap. Every call is checked against that user’s permissions, and finance fields are stripped from writes unless the user holds finance. Lists are paginated, up to 200 rows per page. There are no SDKs or pre-built connectors: ERP, HR and ITSM systems connect through the API, webhooks and CSV. See API and integrations and the developer docs.
