IT documentation

These endpoints need the Support area of the key's role, apart from credentials, which need Credentials. See Keys and permissions.

Assets

Read

The list and asset_mac include each asset's primary network interface - its IP and MAC address and network. The other lookups return the asset alone. The list includes archived assets.

curl -G https://itflow.example.com/api/v1/assets/read.php \
  --data-urlencode "api_key=YOUR_API_KEY" \
  --data-urlencode "client_id=1" --data-urlencode "limit=1"

{
  "success": "True",
  "count": 1,
  "data": [
    {
      "asset_id": "1",
      "asset_type": "Firewall/Router",
      "asset_name": "RDG-FW-01",
      "asset_make": "Netgate",
      "asset_model": "6100 MAX",
      "asset_serial": "F687F5FEB2",
      "asset_os": "pfSense Plus 24.11",
      "asset_status": "Deployed",
      "asset_warranty_expire": "2028-11-08",
      "asset_location_id": "1",
      "asset_client_id": "1",
      "interface_ip": "192.168.10.11",
      "interface_mac": "02:56:C0:D6:2E:2C",
      "interface_network_id": "1",
      "tags": [ { "tag_id": 65, "tag_name": "Business Critical", "tag_kind": "asset", "tag_color": "#d81b60", "tag_icon": "exclamation-circle" } ]
    }
  ]
}

Fields: asset_id, asset_type, asset_name, asset_description, asset_make, asset_model, asset_serial, asset_os, asset_uri, asset_uri_2, asset_uri_client, asset_status, asset_purchase_reference, asset_purchase_date, asset_warranty_expire, asset_install_date, asset_photo, asset_physical_location, asset_notes, asset_favorite, asset_vendor_id, asset_location_id, asset_contact_id, asset_client_id, asset_product_id, asset_invoice_id, asset_invoice_item_id, asset_created_at, asset_updated_at, asset_archived_at, asset_accessed_at, tags. With the interface: interface_id, interface_name, interface_description, interface_type, interface_mac, interface_ip, interface_nat_ip, interface_ipv6, interface_vlans, interface_notes, interface_primary, interface_network_id.

Create

curl -X POST https://itflow.example.com/api/v1/assets/create.php \
  -H "Content-Type: application/json" \
  -d '{"api_key": "YOUR_API_KEY", "client_id": 1, "asset_name": "RDG-WS-14", "asset_type": "Desktop", "asset_make": "Dell", "asset_model": "OptiPlex 7020", "asset_serial": "H7Q2LM3", "asset_os": "Windows 11 Pro", "asset_ip": "192.168.10.64", "asset_mac": "B0:4F:13:2A:9C:11", "asset_network_id": 1, "asset_location_id": 1, "asset_status": "Deployed"}'

Update

Send asset_id, client_id (the asset's own client), and any of the fields under Create, or asset_uri_2 for a second link.

Delete

delete.php takes asset_id and client_id, and needs Full on Support. It also deletes the asset's network interfaces and takes it out of its rack. Credentials linked to it stay with the client.

Networks

Read

Archived networks are left out.

{
  "success": "True",
  "count": 1,
  "data": [
    { "network_id": "1", "network_name": "Office LAN", "network": "192.168.10.0/24", "network_vlan": "10", "network_gateway": "192.168.10.1", "network_dhcp_range": "192.168.10.50 - 192.168.10.220", "network_location_id": "1", "network_client_id": "1" }
  ]
}

Fields: network_id, network_name, network_description, network_type, network_vlan, network, network_subnet, network_gateway, network_primary_dns, network_secondary_dns, network_dhcp_range, network_notes, network_favorite, network_location_id, network_vendor_id, network_client_id, network_created_at, network_updated_at, network_archived_at, network_accessed_at, tags.

Create

Update, archive and unarchive

Each takes network_id and client_id, the network's own client. update.php also takes any of the fields under Create. Only active networks can be changed. Networks can't be deleted through the API.

Credentials

Credentials need the Credentials area of the role, and the key's credential decryption password as api_key_decrypt_password - on reads too. See Credentials.

Read

The list includes archived credentials.

curl -X GET "https://itflow.example.com/api/v1/credentials/read.php?api_key=YOUR_API_KEY&credential_id=1" \
  -H "Content-Type: application/json" \
  -d '{"api_key_decrypt_password": "YOUR_DECRYPTION_PASSWORD"}'

{
  "success": "True",
  "count": 1,
  "data": [
    {
      "credential_id": "1",
      "credential_name": "Firewall Administrator",
      "credential_uri": "https://192.168.10.1",
      "credential_username": "msp-admin",
      "credential_password": "A265CDE06D86CE!aA1",
      "credential_otp_secret": "",
      "credential_password_changed_at": "2026-09-26 16:10:00",
      "credential_asset_id": "1",
      "credential_client_id": "1",
      "tags": [ { "tag_id": 52, "tag_name": "Rotate Quarterly", "tag_kind": "credential", "tag_color": "#6f42c1", "tag_icon": "sync-alt" } ]
    }
  ]
}

Fields: credential_id, credential_name, credential_description, credential_category, credential_uri, credential_uri_2, credential_username, credential_password, credential_otp_secret, credential_note, credential_favorite, credential_password_changed_at, credential_folder_id, credential_contact_id, credential_asset_id, credential_client_id, credential_created_at, credential_updated_at, credential_archived_at, credential_accessed_at, tags.

Create

A field too long to store is turned down with a message that names it, such as "credential_username is too long to store."

curl -X POST https://itflow.example.com/api/v1/credentials/create.php \
  -H "Content-Type: application/json" \
  -d '{"api_key": "YOUR_API_KEY", "api_key_decrypt_password": "YOUR_DECRYPTION_PASSWORD", "client_id": 1, "credential_name": "Imaging Server - local admin", "credential_username": "rdg-admin", "credential_password": "Tq7!mV2#pL9w", "credential_uri": "https://192.168.30.10", "credential_asset_id": 9}'

Update, archive, unarchive and delete

Each takes credential_id and client_id, the credential's own client. update.php also needs api_key_decrypt_password, even when the password isn't changing, and takes any of the fields under Create. Changing credential_password records when it changed, for the credential rotation report. delete.php needs Full on Credentials, and the credential has to be archived first. Deleting one also deletes its shared links.

Licenses

Licenses are called software in the API.

Archived licenses are left out of the list. archive.php and unarchive.php take software_id and client_id.

{
  "success": "True",
  "count": 1,
  "data": [
    { "software_id": "1", "software_name": "Microsoft 365 Business Premium", "software_type": "Software as a Service (SaaS)", "software_license_type": "Subscription", "software_seats": "26", "software_expire": "2026-12-25", "software_client_id": "1" }
  ]
}

Fields: software_id, software_name, software_description, software_version, software_type, software_license_type, software_key, software_seats, software_purchase_reference, software_purchase, software_expire, software_notes, software_favorite, software_vendor_id, software_client_id, software_template_id, software_created_at, software_updated_at, software_archived_at, software_accessed_at, tags.

Domains

Read

Archived domains are left out.

{
  "success": "True",
  "count": 1,
  "data": [
    {
      "domain_id": "1",
      "domain_name": "ravenwooddental.example",
      "domain_expire": "2026-12-20",
      "domain_auto_renew": "0",
      "domain_ip": "203.0.113.10",
      "domain_name_servers": "ns1.harbourdns.example\nns2.harbourdns.example",
      "domain_mail_servers": "0 ravenwooddental.example.mail.protection.example",
      "domain_registrar": "13",
      "domain_refreshed_at": "2026-10-20 04:00:00",
      "domain_client_id": "1"
    }
  ]
}

Fields: domain_id, domain_name, domain_description, domain_expire, domain_auto_renew, domain_ip, domain_name_servers, domain_mail_servers, domain_txt, domain_dmarc, domain_dkim, domain_raw_whois, domain_notes, domain_favorite, domain_registrar, domain_webhost, domain_dnshost, domain_mailhost, domain_client_id, domain_created_at, domain_updated_at, domain_archived_at, domain_accessed_at, domain_refreshed_at, tags.

Create

When a domain is saved, ITFlow looks it up, as the app does, filling in its IP address, name servers, mail servers, TXT, DMARC and DKIM records and WHOIS. The expiry from WHOIS, when it finds one, replaces domain_expire.

Update, archive and unarchive

Each takes domain_id and client_id, the domain's own client. update.php also takes any of the fields under Create, looks the domain up again, and records what changed in the domain's history. Only active domains can be changed. Domains can't be deleted through the API.

Certificates

{
  "success": "True",
  "count": 1,
  "data": [
    { "certificate_id": "1", "certificate_name": "www.ravenwooddental.example", "certificate_domain": "www.ravenwooddental.example", "certificate_issued_by": "Let's Encrypt", "certificate_expire": "2026-11-21", "certificate_check_status": "ok", "certificate_checked_at": "2026-10-20 03:30:00", "certificate_client_id": "1" }
  ]
}

Fields: certificate_id, certificate_name, certificate_description, certificate_domain, certificate_names, certificate_issued_by, certificate_issued_at, certificate_expire, certificate_public_key, certificate_fingerprint, certificate_check_status, certificate_notes, certificate_favorite, certificate_checked_at, certificate_domain_id, certificate_client_id, certificate_created_at, certificate_updated_at, certificate_archived_at, certificate_accessed_at.

Create

With a host, ITFlow connects to it as the certificate is saved, and records what it serves. Certificates can't be changed or deleted through the API.

Services

{
  "success": "True",
  "count": 1,
  "data": [
    { "service_id": "8", "service_name": "Edge Firewall and Site VPN", "service_importance": "High", "service_review_due": "2026-10-02", "service_reviewed_at": "2026-04-05 14:30:00", "service_client_id": "2" }
  ]
}

Fields: service_id, service_name, service_description, service_category, service_importance, service_backup, service_notes, service_favorite, service_review_due, service_reviewed_at, service_review_interval, service_client_id, service_created_at, service_updated_at, service_accessed_at, service_archived_at, tags.

Documents

Read

Archived documents are left out. document_content is the document as HTML.

Fields: document_id, document_name, document_description, document_content, document_content_raw, document_client_visible, document_favorite, document_folder_id, document_created_by, document_updated_by, document_reviewed_by, document_client_id, document_template_id, document_created_at, document_updated_at, document_archived_at, document_accessed_at, document_reviewed_at, tags.

Create

curl -X POST https://itflow.example.com/api/v1/documents/create.php \
  -H "Content-Type: application/json" \
  -d '{"api_key": "YOUR_API_KEY", "client_id": 1, "document_name": "RDG - Imaging Server Notes", "document_description": "How the imaging server is set up", "document_content": "<h2>Imaging server</h2><p>RDG-SRV-02 runs the imaging database. Restart only after 6 PM.</p>"}'

Update, archive and unarchive

Each takes document_id and client_id, the document's own client. update.php also takes any of the fields under Create. The document as it was is kept in its versions, as when it's edited in ITFlow.