Integrate against a contract you can test.

The API is rooted under /api/v1.0/. Confirm the production base URL, supported methods and request schema during onboarding. Treat route names alone as an inventory, not a substitute for an OpenAPI contract.

The API login accepts the account username and password and returns the project token assigned to the user. Browser applications should keep account sessions in secure HTTP-only cookies. Device and server integrations should store project tokens in a secret manager.

POST /api/v1.0/login
Content-Type: application/json

{
  "login_username": "…",
  "login_password": "…"
}

Device routes manage the asset record. Variable routes manage measured, calculated or geospatial signals. Integrations should use stable identifiers and preserve engineering units and timestamp semantics across every write and read.

Dashboard routes expose dashboard names and widget data. Do not couple an enterprise integration to visual widget structure when the underlying device or variable endpoint provides a more stable contract.

Trigger and notification-log routes provide the operational history around configured events. External maintenance or field-service integrations should carry an idempotency key and preserve the originating device, variable, threshold and event time.

• Confirm the production base URL and TLS certificate chain.
• Use a non-human service credential with the minimum required access.
• Document request limits, retry behaviour and timeout budgets.
• Make writes idempotent where retries could create duplicate actions.
• Test malformed payloads, expired credentials and partial upstream outages.
• Record the API contract version accepted by both teams.