Getting Started

Start with the API only after you know which tenant and organization scope your integration needs.

Choose an environment

Environment	Base URL	Use
Test	https://api.dev.iot-sens.schlossers.at	Interactive tests and integration validation.
Local	http://127.0.0.1:3000	Local development.
Production	https://api.iot-sens.schlossers.at	Approved live operations only.

Open the interactive API console to select a server, inspect an operation, fill its parameters and body, and select Test request. For a protected operation, call POST /v1/auth/login, copy the returned access token, and add it to the AccessToken authentication scheme. The console does not persist authentication after the page is closed.

Authentication flow

Current interactive API flow:

1. Authenticate through POST /v1/auth/login.
2. Keep the returned access token in memory and call GET /v1/auth/me to read current roles and organization grants.
3. Refresh through POST /v1/auth/refresh before the access token expires.
4. Send the access token as Authorization: Bearer on protected requests.
5. Sign out through an auth logout endpoint and discard the in-memory token.

Tenant, organization, user, membership, audit, device, device-type, assignment, raw-ingestion, and tenant-scoped flow endpoints are now available under /v1. Platform blocks, templates, and raw-ingestion inspection remain platform-admin operations. Every one of these requests is fail-closed on audit persistence. Use the returned opaque nextCursor unchanged and keep list limits at or below 100. Follow each DELETE contract: administrative resources are soft-disabled, while device-assignment DELETE ends the current historical period.

Start administrative integrations with the Core Administration API, Resource Inventory API, and Audit API. Telemetry and export entity endpoints remain later slices; do not integrate against those planned paths yet.