A versioned REST API at /api/v1, signed outbound webhooks and a live event stream — so a monitoring broker, a BI tool or your own automation can read devices, locations, circuits, alerts and tickets, acknowledge alerts, open tickets and push events in, scoped to exactly the companies you are granted.
Every outage SmartTile sees is useful somewhere else too — a partner's monitoring console, a data warehouse, a runbook tool. The Partner API makes SmartTile a source for those systems instead of another screen to watch. Access is provisioned by SmartChoice: a partner record is created with its own scopes, company grants and limits, and from then on the partner manages its own webhooks through the API. The developer guides are public at /developers.
Organizations and sub-organizations, locations, devices and live device status, device telemetry and history, circuits, alerts, tickets and an events timeline — each behind its own read: scope, paged, tenant-filtered.
Acknowledge an alert. Open a ticket on a device (through SmartTile's normal ticket path, so the first journal names the partner and the site), update it, add notes.
/inbound/incidents opens a ticket; /inbound/events with critical severity on a known device raises an alert; /inbound/notifications is logged. Idempotent by event UUID; 30 events per device per minute.
Subscribe a URL to event types — device.hard_down, device.restored, device.flapping, alert.created/resolved/acknowledged, ticket.opened/note_added, escalation.*, config_backup.changed — with an optional company filter.
GET /stream/events holds a server-sent-events connection with a 25-second heartbeat. Forward-only: it streams from connect time, it does not replay history.
GET /audit returns the partner's own request log. Every call is written to a hash-chained log that is re-verified every night at 03:15.
SmartChoice creates the partner in the Partner API console (/admin/api/partners/new, SmartChoice super admins): contact, OAuth and/or HMAC, token lifetime, IP allow-list, CORS origins and rate limits.
Scopes (least privilege — read:devices, write:tickets, …) and the companies — optionally narrowed to organizations — the partner may see.
An OAuth client id + secret, or an HMAC key id + secret. Each secret is shown once, at creation.
Follow Quickstart, Auth and Webhooks at /developers, try calls in the API reference, then POST /webhooks and POST /webhooks/id/test.
/oauth/token · /oauth/revokeClient-credentials bearer token/organizations · /organizations/{id}/sub-organizationsread:organizations/locations · /locations/{id}read:locations/devices · /devices/{id} · /devices/{id}/statusread:devices/devices/{id}/telemetry · /devices/{id}/historyread:telemetry/circuits · /alerts · /tickets · /eventsread:circuits · alerts · tickets · events/alerts/{id}/acknowledgewrite:alerts/tickets · PATCH /tickets/{id} · POST /tickets/{id}/noteswrite:tickets/inbound/events · /notifications · /incidentswrite:inbound/stream/eventsread:stream (SSE)/webhooks · PATCH/DELETE /webhooks/{id} · /test · /deliverieswrite:webhooks/audit · /health · /openapi.jsonread:audit · no auth · no authX-SmartTile-Signature: v1= HMAC-SHA256 of timestamp.body with your subscription's secret, plus event id, type, delivery id and timestamp headers.
10-second timeout; retries at 30 s, 2 min, 10 min, 1 h, 6 h and 24 h. GET /webhooks/id/deliveries shows every attempt and response code.
After 6 consecutive failures the subscription is paused and SmartChoice is e-mailed; you re-enable it with PATCH.
Every request loads the partner's company grants (and organization filters) and applies them to the query; a webhook only fires for events in a granted company.
OAuth client secrets and HMAC secrets are encrypted at rest; bearer tokens are stored only as SHA-256 hashes. Signed requests carry a nonce and must be within 5 minutes.
Per-minute and per-hour limits per partner, returned on every response in X-RateLimit-* headers; IP allow-list by CIDR; errors as RFC 9457 problem+json.
SmartChoice can suspend a partner, revoke a key or token, or revoke a webhook; access ends on the next request.