Public API v1

The public REST API is intended for server-to-server integrations with, for example, CRM or billing software.

Base URL: https://auto.manisma.com/api/v1

Do not use the Directus API directly and never place an API key in frontend JavaScript.

Creating an API key

As an Admin, open Admin → API keys. Give the key a recognizable name and choose scopes:

• read: marks a key intended for reading;
• write: create or modify writable resources and use scheduling endpoints.
• plan: request a scheduling proposal.

For a normal read/write integration, select both scopes. Note: the current v1 backend checks write explicitly for POST/PATCH, but allows GET for any valid active key; read is therefore currently an administrative label and not yet a separate technical block. The raw key starts with msk_, is shown once, and cannot be recovered. If lost, create a new key and deactivate or delete the old one.

Authentication

Use one of these headers:

Authorization: Bearer msk_...

X-API-Key: msk_...

All results are server-side scoped to the key’s organization. An id from another tenant returns the same 404 as an unknown id.

Resources and methods

There is no DELETE endpoint in v1.

Lists and pagination

GET /clients?limit=50&page=1

• limit: 1 to 100, default 50;
• page: starts at 1.
• search: for client and material lists, case-insensitive partial matching of literal text. A percent sign searches for a percent sign. Clients match name, email, or customer number; materials match SKU or name.

{
  "data": [],
  "meta": { "total": 0, "page": 1, "limit": 50 }
}

A detail or write response uses { "data": { ... } }.

Clients

Read fields: id, tenant_id, customer_number, name, client_type, email, phone, vat_number, status, created_at, updated_at.

POST /clients requires name. Allowed write fields are name, customer_number, client_type, email, phone, vat_number, and status. For PATCH they are all optional, but at least one valid field must be present. Unknown fields and a supplied tenant_id are ignored.

POST /addresses creates an address for a client and requires client_id. The client must belong to the same tenant.

curl -X POST 'https://auto.manisma.com/api/v1/clients' \
  -H 'Authorization: Bearer msk_...' \
  -H 'Content-Type: application/json' \
  -d '{"name":"Bakkerij Peeters","client_type":"b2b","email":"info@example.com"}'

Jobs

Read fields include id, tenant, job number, client id, title, description, priority, status, expected duration, lead technician id, required number of technicians, scheduling, service address id, task type id, required skills, and timestamps. Internal and technician notes are not exposed.

POST /jobs requires title. Allowed fields:

job_number, client_id, title, description, priority, status, estimated_duration_minutes, required_technicians, scheduled_date, scheduled_start, scheduled_end, service_address_id, task_type_id, required_skills.

When status is missing, unplanned is used. When job_number is missing, Manisma generates a number with the configured tenant prefix. For PATCH, job_number, status, and assigned_technician_id cannot be changed.

Foreign keys for client, service address, and task type must belong to the same tenant.

POST /jobs/:id/assign schedules a job with technician_id, scheduled_start, and scheduled_end. POST /jobs/:id/unassign removes its assignment and returns it to the unplanned queue; it does not delete the job.

Planning proposal

POST /plan returns a scheduling proposal and changes nothing: it does not create or move any job. It requires the separate plan scope and is limited to 3 calls per organization per 10 minutes; further calls return a clear 429 error. It does not use Manisma’s AI or consume the AI actions included in your Manisma plan, because your calling assistant supplies the reasoning.

Other resources

• assets: installed devices at a client; writable with POST and PATCH.

• task_types: writable with POST and PATCH.

• materials: writable with POST and PATCH; purchase price and stock are readable and writable.

• asset_models: read-only.

• technicians: name, email, phone, active status, and skills. Work hours, addresses, and user id are not public.

Errors and limits

The API is limited to 600 requests per minute per source IP. Build retries with exponential backoff for 429, 502, and temporary network errors. Do not retry validation errors without correcting the request.