assets API · Marula PSA docs

API reference

9 operations in assets. Raw spec: openapi.json.

GET/api/v1/assets

GET /api/assets — org-wide, filterable (resource REST for external-DMS parity; the client-scoped tab narrows with `?client_id=`).

Parameters

Name	In	Type	Required	Description
`client_id`	query	—	No
`scope`	query	—	No	client \| internal_org (migration 0103).
`layout_id`	query	—	No
`q`	query	—	No	Substring over tag, name, and custom fields.

Responses

Status	Description
`200`

Security: bearer

POST/api/v1/assets

POST /api/assets — instant-first (IF1/IF2).

Request body

CreateAssetRequest

Responses

Status	Description
`200`
`409`	idempotency key reused
`422`	fields rejected by the layout schema

Security: bearer

GET/api/v1/assets/integration-links

GET /api/assets/integration-links — per-connector link state as data (QBO/Xero and friends): linked/unlinked + last-touch timestamps. No live sync runs here; the `ConfigSourceLink` seam (ADR 0003) attaches per-asset state when it lands.

Responses

Status	Description
`200`

Security: bearer

GET/api/v1/assets/{id}

GET /api/assets/{id}

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`
`404`	asset not visible in scope

Security: bearer

PATCH/api/v1/assets/{id}

PATCH /api/assets/{id} — instant-first (IF1/IF2); absent = keep. A layout change re-validates the effective fields against the NEW schema.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Request body

UpdateAssetRequest

Responses

Status	Description
`200`
`404`	asset not visible in scope
`409`	version conflict or idempotency key reused
`422`	fields rejected by the layout schema

Security: bearer

DELETE/api/v1/assets/{id}

DELETE /api/assets/{id} — the audit trail keeps the events; link rows survive and surface as broken targets (docs-platform semantics: never cascade-deleted). Mirrors the vault's delete shape (`deleted: true`), which intentionally rides no instant-first envelope.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`	deleted
`404`	asset not visible in scope

Security: bearer

GET/api/v1/assets/{id}/links

GET /api/assets/{id}/links — the related-items panel.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`

Security: bearer

POST/api/v1/assets/{id}/links

POST /api/assets/{id}/links

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Request body

CreateAssetLinkRequest

Responses

Status	Description
`200`
`404`	asset or link target not visible in scope
`409`	link already exists

Security: bearer

GET/api/v1/assets/{id}/vault

GET /api/assets/{id}/vault — the asset's vault entries: password rows LINKED to this asset (password→asset). Strict posture: metadata only (title/username/url/expiry) under `passwords:view`; secrets exist only behind the audited `/passwords/{id}/reveal` endpoint, which requires `passwords:edit` — the UI must render role-gated reveal, never a dead button. No ciphertext ever appears in this response.

Parameters

Name	In	Type	Required	Description
`id`	path	string	Yes

Responses

Status	Description
`200`
`404`	asset not visible in scope

Security: bearer