The Monaveo Public API lets you integrate your organisation’s data with your own systems — dashboards, reporting, data warehouses, PSA sync, or automation. It is a read + write + delete REST API, scoped strictly to your organisation, authenticated with a Bearer API key you generate yourself. It never exposes credentials, remote-access passwords, payment identifiers, or another tenant’s data.
Base URL (EU): https://app.monaveo.com/api/v1/public
Base URL (US): https://us-app.monaveo.com/api/v1/public
Auth: Authorization: Bearer mvk_live_…
Rate limit: 120 requests / minute / key
API keys are a paid-plan feature. In the dashboard, an organisation admin opens Settings → API Keys, clicks Generate key, and copies it. The key is shown once — store it securely (we keep only a salted hash). Each key carries per-resource permissions — choose Full (read + write + delete on everything) or Custom (a level of read, write, or delete per resource). You can optionally lock a key to specific IPs/CIDRs, set an expiry, and rotate or revoke any key instantly. Up to 10 active keys per organisation.
curl https://app.monaveo.com/api/v1/public/me \
-H "Authorization: Bearer mvk_live_xxxxxxxxxxxxxxxx"Prefer an interactive reference? Browse and try every endpoint live in our Swagger / OpenAPI explorer (or download the OpenAPI spec).
Whether a key may call a given method depends on its granted level for that resource (read for GET, write for POST/PATCH, delete for DELETE). Devices are agent-enrolled, so they have no create. Invoices are read-only by design — a deliberate money/safety gate that no key can override.
| Method | Path | Purpose |
|---|---|---|
| GET | /me | Your organisation (name, plan, seats, currency, status) |
| GET | /devices ?search&os_type&customer_id&active | Managed devices/assets |
| GET · PATCH · DELETE | /devices/{id} | Read / update asset fields / delete a device |
| GET · POST | /customers ?search&country&active | List / create customers |
| PATCH · DELETE | /customers/{id} | Update / delete a customer |
| GET · POST | /tickets ?status&priority&customer_id&search | List / create tickets |
| PATCH · DELETE | /tickets/{id} | Update / delete a ticket |
| GET | /alerts ?active=true&severity&device_id | Device alerts |
| PATCH · DELETE | /alerts/{id} | Acknowledge / resolve / clear an alert |
| GET | /threats ?active=true&severity&device_id | Security detections (Recent Threats) |
| PATCH · DELETE | /threats/{id} | Resolve / delete a threat |
| GET · POST | /kb ?search&status&visibility | List / create knowledge-base articles |
| PATCH · DELETE | /kb/{id} | Update / delete an article |
| GET | /invoices ?status&customer_id | Invoice headers (read-only by design) |
List endpoints return { "data": [ … ], "count": N }. Write calls (POST/PATCH) take a JSON body and validate every field against an allowlist — e.g. ticket priority must be one of low, medium, high, critical. Example list response (/devices, fictional data):
{
"count": 2,
"data": [
{ "id": 1, "hostname": "WS-EXAMPLE-01", "os_type": "windows",
"agent_version": "1.4.36", "customer_id": 10, "last_seen": "2026-01-01T12:00:00Z" },
{ "id": 2, "hostname": "SRV-EXAMPLE-02", "os_type": "linux", "agent_version": "1.4.36" }
]
}Create a ticket (fictional data):
curl -X POST https://app.monaveo.com/api/v1/public/tickets \
-H "Authorization: Bearer mvk_live_xxxxxxxxxxxxxxxx" \
-H "Content-Type: application/json" \
-d '{"subject":"Printer offline in reception","priority":"high","customer_id":10}'read, write, or delete per resource; a call beyond the granted level is rejected with 403.