Using the AssetTrove API
The basics for developers: authentication, formats, pagination, safe retries, concurrency and rate limits.
Everything you can do in AssetTrove can also be done through its REST API, and a read-only GraphQL API is available for flexible inventory queries. This article covers the conventions that apply everywhere.
Authentication
Send an API key as a bearer token:
GET /api/v1/hardware-assets?status=IN_USE
Authorization: Bearer itam_live_<id>_<secret>
Your organisation is taken from the key. An ID that belongs to another organisation always returns 404 Not found.
Formats
| Type | Format | Example |
|---|---|---|
| IDs | UUID | 0f8c2b0e-6d0a-4c1e-9a51-6b8f8d7f2a10 |
| Timestamps | UTC, RFC 3339 | 2026-11-12T17:34:05.120Z |
| Dates | YYYY-MM-DD |
2026-01-10 |
| Money | Decimal string plus currency | { "amount": "1500.00", "currency": "EUR" } |
| Field names | camelCase | assetTag |
Unknown fields in a request are rejected, which catches typos. Responses may gain new fields at any time, so ignore fields you don't recognise.
Lists and pagination
Lists return up to 50 items by default (maximum 200) and a cursor for the next page:
{ "data": [ ... ], "page": { "nextCursor": "eyJr...", "hasMore": true, "limit": 50 } }
Pass cursor= to get the next page. Totals aren't included by default because they're slow on large estates; add includeTotal=true if you need one.
Filters are query parameters. Repeat a parameter for or (status=IN_USE&status=IN_REPAIR), use q= to search (at least 3 characters), and sort=-updatedAt for descending order.
Safe retries
Send an Idempotency-Key header on POST requests. If the network fails and you retry with the same key, AssetTrove returns the original result instead of doing the work twice. Some endpoints require it, such as sending discovery data and allocating licences.
Avoiding overwrites
Items that people edit have a version. Read the ETag header and send it back as If-Match when you update. If someone changed the item in the meantime, you get 412 with the current version, instead of silently overwriting their change.
Warnings
Some successful changes return warnings, for example when an assignment is back-dated into a closed depreciation period. Log them.
Rate limits
| What | Limit |
|---|---|
| API requests | 600 per minute per organisation, 120 per minute per key or user |
| Discovery batches | 60 per minute, 2 runs processing at once |
| Reconciliation runs | 1 at a time, 24 per day |
| Exports | 10 per hour |
Responses include RateLimit-* headers. When you hit a limit you get 429 with a Retry-After header. Enterprise plans can have higher limits.
Errors
Errors use a standard problem format with a machine-readable code, for example ASSET_HAS_OPEN_ASSIGNMENT, and often a context object with details. Every response carries an X-Request-Id; include it when you contact us.