Skip to main content

REST API

Manage1to1 includes a read-only REST API so your district can pull data (devices, users, buildings, tickets, incidents, and custom fields) into your own reporting, dashboards, or integrations.

Access is controlled by tokens that you issue yourself. Each token is limited to exactly the data you choose and can only be used from network locations you approve, so you decide precisely what any integration can reach.

Your interactive reference lives inside the app

Every instance hosts its own interactive API documentation, kept perfectly in step with your version. You can browse every available endpoint, see the exact fields returned, and try live requests right from the page. This guide covers how to issue a token and where to find that reference. Open API Docs from the console for the endpoint details themselves.

Finding the API Console​

Go to Settings → API Tokens.

From here you can:

  • Issue a new token with a name, a set of permissions, and approved network locations
  • Review existing tokens: their name, permissions, when they were last used, and when they expire
  • Revoke a token the moment it is no longer needed
  • Open the API Docs, the interactive reference for your instance

The API Tokens console, listing an issued token with its name, masked token value, granted permissions, approved locations, and expiry, alongside the API Docs and Create Token buttons

Issuing a Token​

Select Create Token and complete the form:

  1. Name: a short, recognizable label (for example, State reporting export or Nightly device sync) so you can tell your tokens apart later.
  2. Permissions: choose only the data this token should read. Permissions are grouped by area (devices, users, buildings, tickets, incidents, custom fields). A token can never do more than the permissions you grant it.
  3. Approved locations: enter the network locations allowed to use this token. This is required. A token with no approved location cannot be used at all.
  4. Expiration: every token has an expiry date, so access never lingers indefinitely.
Copy your token immediately

For your security, the full token is shown only once, at the moment you create it. Copy it and store it somewhere safe right away. If you lose it, you cannot see it again. Simply revoke it and issue a new one.

Approved Locations​

Every token is tied to the network locations allowed to use it. We strongly recommend listing single addresses (the specific locations your integration actually runs from) rather than broad ranges.

  • Single addresses are entered directly, one per line.
  • Ranges are supported when a single address isn't practical, but only up to a modest span. Very broad ranges are rejected, so a token can never be usable from anywhere on the internet.

If a request arrives from a location that isn't on the token's approved list, it is refused before any data is returned.

Choosing Permissions Well​

The safest token is the one that can do the least. When you set up an integration, grant only the permissions it genuinely needs:

  • A device-inventory sync needs only device access.
  • A help-desk dashboard needs only ticket and incident access.

If an integration's needs change later, issue a new token with the right permissions and revoke the old one.

Sensitive data is flagged

Some permissions grant access to personal information about students and staff. These are clearly marked when you choose permissions, so you can be deliberate about which tokens are allowed to read them.

Revoking a Token​

If a token is no longer used, or you suspect it has been exposed, revoke it from Settings → API Tokens. Revocation takes effect immediately, and any further requests using that token are refused at once. Issue a fresh token for anything that still needs access.

Related articles

Loading…