API Reference
Complete API documentation with request/response examples, code samples, and detailed parameter descriptions.
Authentication
User authentication, token management, and MFA
Business Plan
Proposals, templates, packages, quotation, revenue forecast, profitability, AI recommendations
Billing & Invoicing
Invoice generation, payment tracking, and pricing
Approvals
Pending approvals, approve/reject, workflows
AI
AI settings, agents, chat, analytics, pricing
AI InsightsNew
AI Insight Inbox — list and triage deduped platform insights
AI Services (Phase 5)New
Documentation Assistant, SIM advisor, sync incidents, proposal optimizer
Projects
Project management and organization
Orders
Order management, fulfillment, edit, delete, shipped and delivered statuses
SIM Management
SIM card lifecycle, activation, deactivation, and status
Device Management
Device tracking, configuration, and lifecycle
Tenant & Theme
Tenant theme configuration, branding, logos, and colors
Support & Tickets
Support ticket management
Inventory
Device and SIM stock summary and counts
Pricing Packages
Pricing packages, provider prices, contract storage
Reports
Usage report, profitability, daily usage, AI analytics
Users
User management, invite, assign to tenant
Imports
Import tracking and status
lockAuthentication
Most endpoints require authentication using a Bearer token in the Authorization header or an X-Api-Key header for scoped API keys:
Authorization: Bearer <your-access-token>X-Api-Key: <your-api-key>For server-to-server integrations, tenant administrators can create scoped API keys in the admin console. Keys use the X-Api-Key header and are limited to explicit permission codes on protected routes.
API key scope and limits
- Every key is bound to the tenant it was created in. Passing tenantId in a query string or body cannot switch tenants for anyone except platform super administrators, so a key only ever reads its own tenant's data.
- Keys can be narrowed further with a client scope, which limits them to the selected CRM clients' projects and devices.
- Permission codes are singular (device:read, sim:read, ticket:read). Keys are rejected on endpoints that declare no explicit permission, and can never hold wildcard (*), api-keys:manage, tenant:manage, tenant:platform-manage or role:manage.
- Call GET /api/v1/auth/me with your key to confirm the tenant, permissions and client scope it is bound to.
curl -H "X-Api-Key: <your-api-key>" http://127.0.0.1:4173/api/v1/api/v1/auth/meObtain your access token by logging in through the login endpoint or using an API key. API keys can be managed through the admin panel.
Base URL: All API endpoints are prefixed with http://127.0.0.1:4173/api/v1
Configured via VITE_API_BASE_URL
Try the API sandbox
Sign in to explore endpoints with your tenant credentials.