API documentation

With the API another system reads and writes data in your Asset Management System. With webhooks that system is notified the moment something happens.

1. Create an API key under Settings > Integrations and API.
2. Send the key with every request.
3. Optionally add a webhook to receive events.

curl https://ams.software/api/v1/assets?limit=2 \
  -H "Authorization: Bearer ams_live_..."

Base URL: https://ams.software/api/v1. Field names are Dutch, as in the system; error messages are English.

Every request carries the Authorization header with your key. A key belongs to one organisation and only sees that organisation’s data.

Authorization: Bearer ams_live_...

• A key is read-only, or read and write. You choose when creating it.
• You see the key once. We only store a hash.
• Use one key per system, so you can revoke it separately.

GET https://ams.software/api/v1/<resource>
GET https://ams.software/api/v1/<resource>/<id>

• limit (default 100, maximum 500) and offset for paging; the response contains paging.next_offset.
• updated_since (ISO 8601 date) returns only what changed since; not for budgetten and kosten.
• Filters are exact values, for example ?locatie_id=…&status=open.

{
  "data": [ { "id": "…", "nummer": "A-0059", "naam": "…", "locatie_id": "…" } ],
  "paging": { "limit": 100, "offset": 0, "total": 79, "next_offset": null }
}

Writing requires a key with write access. Every change is recorded in the audit log, with the name of the key.

Create a report or breakdown

POST https://ams.software/api/v1/meldingen

{
  "titel": "Lekkage plafond gang",
  "omschrijving": "Water bij de lift",
  "soort": "melding",            // or "storing"
  "urgentie": "normaal",          // laag | normaal | hoog | spoed
  "asset_nummer": "A-0059",       // or asset_id / asset_extern_id / locatie_id
  "gemeld_door": "Jan Jansen",
  "fotos": ["https://…"]
}

Required: titel, and an asset or locatie_id. The responsible person from the process agreements automatically gets a task to assess the report. A breakdown sets the asset to breakdown status.

Update a report

PATCH https://ams.software/api/v1/meldingen/<id>

{ "status": "in_behandeling", "bericht": "Monteur komt morgen" }
// status: in_behandeling | hersteld_gemeld   also: oplossing

Update a work order

PATCH https://ams.software/api/v1/werkorders/<id>

{ "status": "geaccepteerd", "verwachte_datum": "2026-12-03" }
// status: geaccepteerd | in_uitvoering | gereed_gemeld   also: gereed_tekst, extern_referentie

A work order still waiting for manager approval cannot be updated (409). Closing and accepting completion is done by the client in the system.

Add an https address under Settings > Integrations and API and choose the events. We send a POST with JSON as soon as something happens.

POST https://uw-systeem.example/hook
X-AMS-Event: werkorder.goedgekeurd
X-AMS-Delivery: <id>
X-AMS-Signature: t=1794480000,v1=<hex>

{
  "id": "<id>",
  "type": "werkorder.goedgekeurd",
  "created": "2026-11-12T11:30:00Z",
  "data": { "werkorder": { "id": "…", "nummer": 12, "titel": "…", "status": "gepland" } }
}

Managing webhooks through the API

A platform can subscribe and unsubscribe itself with a key with write access. The secret is only returned in the response to the create call.

POST   https://ams.software/api/v1/webhooks        { "url": "https://…", "events": ["melding.aangemaakt"] }
GET    https://ams.software/api/v1/webhooks
DELETE https://ams.software/api/v1/webhooks/<id>

Verifying the signature

Compute HMAC-SHA256 over "<t>.<body>" with the webhook secret (whsec_…) and compare with v1. Reject messages whose t is older than five minutes.

import { createHmac, timingSafeEqual } from 'crypto';

function geldig(header, body, geheim) {
  const { t, v1 } = Object.fromEntries(header.split(',').map((x) => x.split('=')));
  const verwacht = createHmac('sha256', geheim).update(t + '.' + body).digest('hex');
  return Math.abs(Date.now() / 1000 - Number(t)) < 300
    && timingSafeEqual(Buffer.from(v1), Buffer.from(verwacht));
}

Respond within five seconds with a 2xx status. Otherwise we retry after 1, 5, 30, 120 and 720 minutes. Use X-AMS-Delivery to recognise duplicates.

{ "error": { "code": "validation_error", "message": "Field \"titel\" is required." } }

Every request is kept for 90 days in the log under Settings > Integrations and API.

You can already connect without code using the webhook and HTTP building blocks in these platforms:

• Receiving events: create a "Catch hook" or "Custom webhook" in the platform and paste that address under Webhooks.
• Fetching data or creating a report: use an HTTP step with your key in the Authorization header.

Ready-made apps for Zapier and Make, and standard integrations with Exact Online, AFAS and TOPdesk, are in preparation.

Besides the open API we build standard integrations with widely used packages. This is the current status; customers register their interest in the system, which sets our order.