Developers
A REST API and webhooks for your asset data
Read and write assets and people programmatically, and subscribe to 41 signed events so the rest of your stack finds out the moment something is issued, returned or falls due.
Does Stackroom have an API?
Yes. Stackroom publishes a versioned REST API at /api/v1, authenticated with scoped API keys, plus signed webhooks covering 41 events. Both are available on the Pro plan and above, and the OpenAPI specification is public — you can read it before you sign up.
What you get
Built to be integrated against
Scoped API keys
Read or read-write, hashed at rest, shown once, revocable instantly. A key is bound to one organisation and its ids are never valid across tenants.
REST over JSON
Assets, people and workspace members, with pagination, filtering and search. Writes go through the same domain services as the console, so plan limits and validation apply identically.
41 signed events
Assets, custody, requests, audits, people, warranty, maintenance, bookings, reminders and plan changes. HMAC-SHA256 over a timestamped payload, with retries and a delivery log.
Published limits
Per-minute rate limits and a monthly quota, both set by your plan. Every response carries X-RateLimit-* and X-Quota-* headers so a client can back off before it is throttled.
Replay-resistant
The delivery timestamp is part of what we sign, so a captured payload cannot be replayed against a correct verifier. Every delivery carries a unique id for deduplication.
A real OpenAPI (Swagger) document
Generated from the controller that serves the requests, published in production, and usable directly in Postman, Insomnia or a code generator.
Quickstart
Two requests and you are integrated
# List assets
curl "https://api.stackroom.io/api/v1/assets?page=1&pageSize=100" \
-H "Authorization: Bearer sk_live_your_key"
# Create a person (needs a write-scoped key)
curl -X POST https://api.stackroom.io/api/v1/people \
-H "Authorization: Bearer sk_live_your_key" \
-H "Content-Type: application/json" \
-d '{"full_name":"Jane Doe","email":"[email protected]"}'POST https://your-endpoint.example.com/hooks
X-Stackroom-Event: assignment.checked_out
X-Stackroom-Delivery: 4f1c8a02-9d3e-4a11-8f77-1b2c3d4e5f60
X-Stackroom-Timestamp: 1789041296
X-Stackroom-Signature: sha256=9f86d081884c7d659a2feaa0c55ad015…
{
"id": "4f1c8a02-9d3e-4a11-8f77-1b2c3d4e5f60",
"event": "assignment.checked_out",
"created_at": "2026-09-14T12:34:56.000Z",
"data": { "id": "cml0…", "assetId": "cmk9…", "to": "Jane Doe", "dueDate": "2026-09-21" }
}Events
What you can subscribe to
Assets
created, updated, deleted, restored, condition changed, scanned
Custody
checked out, checked in, overdue
Requests
created, approved, rejected
Audits
started, completed, item reported missing
People & members
person added, person offboarded, member invited, member removed
Warranty & maintenance
expiring, expired, maintenance opened, maintenance resolved
Bookings
created, requested, confirmed, cancelled, checked out, completed, overdue, no-show
Reminders
reminder due
Plan & usage
plan changed, plan limit reached
Every event carries the same envelope — { id, event, created_at, data } — and every delivery is signed, retried and logged. Subscribe to any subset per endpoint, and use the Test button to send a real ping through the live delivery path.
FAQ
Developer questions
Is the Stackroom API free to use?
API access is included on the Pro plan and above. The plan gate is checked on every request rather than only when a key is created, so access follows your current plan — and existing keys resume working unchanged after an upgrade.
How do I authenticate?
Send your key as a bearer token: Authorization: Bearer sk_live_…. An x-api-key header works identically. Keys are created in Settings → API & Webhooks and the raw value is shown exactly once, because only a hash is stored.
What are the rate limits?
Two ceilings, both per key and both set by your plan: a per-minute rate limit and a monthly quota. Every response carries X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset and the X-Quota-* equivalents, so a well-behaved client never needs to hit a 429 to discover where it stands.
How do I verify a webhook signature?
Compute HMAC-SHA256 over the string `<timestamp>.<raw request body>` using the endpoint's signing secret, hex-encode it and prefix it with sha256=. Compare against X-Stackroom-Signature in constant time, and reject deliveries whose X-Stackroom-Timestamp is more than five minutes old.
What happens if my endpoint is down?
Three attempts with a short backoff, ten seconds each. Network errors, timeouts, 429 and any 5xx are retried; other 4xx responses are treated as permanent. Every attempt is recorded in a delivery log you can inspect in the console.
Are webhook deliveries guaranteed exactly once?
No — delivery is at-least-once. A retry re-sends the same delivery id, so treat that id as an idempotency key and deduplicate on it. Ordering is not guaranteed either; use the created_at timestamp rather than arrival order.
Can I create assets programmatically?
Yes, with a write-scoped key. Records created through the API are attributed as API in the activity feed, and they fire the same webhook events a human action would.
Is there an OpenAPI specification?
Yes, served in production and generated from the same controller that handles the requests, so it cannot drift from the implementation. Point Postman, Insomnia or a client generator straight at it.
Start building
Create an account, generate a key in Settings → API & Webhooks, and call /v1/ping to check it works.