The API is included in the plan. The account owner creates keys in the developer settings. For a test account, email hello@storebay.co.uk.

Developers
Access

Create a hardware device

POST
/hardware-devices

Authorization

AuthorizationBearer <token>

Present an API key (sb_live_… / sb_test_…), an OAuth2 access token, or a static token as a Bearer credential. The operator is implied by the credential; it is never in the path. Only a SHA-256 hash of an API key is stored server-side.

In: header

Header Parameters

Idempotency-Key?string

A unique key that makes this mutation safe to retry. Repeats replay the stored response; reuse with a different body returns 409 idempotency_conflict.

Lengthlength <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/hardware-devices" \  -H "Content-Type: application/json" \  -d '{    "site_id": "72771e6a-6f5e-4de4-a5b9-1266c4197811",    "vendor": "noke"  }'
{  "data": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "object": "hardware_device",    "site_id": "72771e6a-6f5e-4de4-a5b9-1266c4197811",    "unit_id": "5becc822-b69e-4e66-a762-ad8e868dcab6",    "vendor": "noke",    "device_type": "smart_lock",    "external_device_id": "string",    "name": "string",    "status": "online",    "firmware": "string",    "last_seen_at": "2019-08-24T14:15:22Z",    "created_at": "2019-08-24T14:15:22Z",    "updated_at": "2019-08-24T14:15:22Z"  }}
{  "error": {    "code": "unauthorized",    "message": "Missing or invalid credential."  }}
{  "error": {    "code": "insufficient_scope",    "message": "The credential lacks a scope required by this endpoint."  }}
{  "error": {    "code": "validation_error",    "message": "One or more fields are invalid.",    "details": [      {        "field": "email",        "issue": "must be a valid email address"      }    ]  }}
{  "error": {    "code": "rate_limited",    "message": "Rate limit exceeded. Retry after 7s."  }}
{  "error": {    "code": "validation_error",    "message": "string",    "details": [      {        "field": "string",        "issue": "string"      }    ]  }}

Create an access credential POST

Refused with 409 `access_held` while the credential is for a booking whose access is waiting for the customer's ID to be checked (by its agreement, the unit it has, or its customer at the site). The check passing issues the credential itself, so there is nothing to retry.

Delete a device DELETE

Permanently removes a device that nothing references. This is for a record that should never have existed — a duplicate, a typo, a mistaken entry. If ANY other record points at it the request is refused with 409 and `error.details` lists what was found; archive it instead where an archive verb exists. Deleting is not a GDPR erasure: erasure is handled separately and respects legal hold.