Standards and Interoperability

Technical expectations for every integrator. These rules keep clients interoperable with the published schemas and with each other.

API standards

• Protocol. HTTPS with TLS 1.2 or higher.
• Format. JSON request and response bodies.
• Versioning. Paths are versioned under /v1. Breaking changes increment the path version.
• Identifiers. Resource references use UUIDs (user_uuid, asset_uuid). Raw integer IDs are not exposed on public contracts.

Schema compatibility

Integrators must use the unified models in Data Models.

• Extensibility. Custom fields belong in specified JSON objects (for example org_business_identifiers), not as new top-level properties.
• Enums. Status and category fields use the integer values in Enums.
• Naming. Asset Manufacturer and Asset Model names are preserved as defined in the registry.

Security standards

• JWT handling. Access tokens are stored securely and never placed in URL parameters.
• API key protection. partner-api-key credentials stay on the server side and are never exposed in client applications.
• Rate limiting. Clients honour Retry-After headers and HTTP 429 responses.

Implementation checklist

1. Validate request bodies against the published schemas on each API page.
2. Handle common error responses (400, 401, 403, 404, 422, 500) using the envelope in Base URL and responses.
3. Use the Resource Memberships API as the primary mechanism for relationships between users, organisations, and assets.
4. Exercise flows first in the Sandbox via the Integration Kit.