StoreBay Developers
Access

Create a hardware device

POST
/hardware-devices

Authorization

AuthorizationBearer <token>

Present an API key (sb_live_… / sb_test_…), an OAuth2 access token, or a static token as a Bearer credential. The operator is implied by the credential; it is never in the path. Only a SHA-256 hash of an API key is stored server-side.

In: header

Header Parameters

Idempotency-Key?string

A unique key that makes this mutation safe to retry. Repeats replay the stored response; reuse with a different body returns 409 idempotency_conflict.

Lengthlength <= 255

Request Body

application/json

TypeScript Definitions

Use the request body type in TypeScript.

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

curl -X POST "https://example.com/hardware-devices" \  -H "Content-Type: application/json" \  -d '{    "site_id": "72771e6a-6f5e-4de4-a5b9-1266c4197811",    "vendor": "noke"  }'
{  "data": {    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",    "object": "hardware_device",    "site_id": "72771e6a-6f5e-4de4-a5b9-1266c4197811",    "unit_id": "5becc822-b69e-4e66-a762-ad8e868dcab6",    "vendor": "noke",    "device_type": "smart_lock",    "external_device_id": "string",    "name": "string",    "status": "online",    "firmware": "string",    "last_seen_at": "2019-08-24T14:15:22Z",    "created_at": "2019-08-24T14:15:22Z",    "updated_at": "2019-08-24T14:15:22Z"  }}
{  "error": {    "code": "unauthorized",    "message": "Missing or invalid credential."  }}
{  "error": {    "code": "insufficient_scope",    "message": "The credential lacks a scope required by this endpoint."  }}
{  "error": {    "code": "validation_error",    "message": "One or more fields are invalid.",    "details": [      {        "field": "email",        "issue": "must be a valid email address"      }    ]  }}
{  "error": {    "code": "rate_limited",    "message": "Rate limit exceeded. Retry after 7s."  }}
{  "error": {    "code": "validation_error",    "message": "string",    "details": [      {        "field": "string",        "issue": "string"      }    ]  }}

Create an access credential POST

Previous Page

Delete a device DELETE

Permanently removes a device that nothing references. This is for a record that should never have existed — a duplicate, a typo, a mistaken entry. If ANY other record points at it the request is refused with 409 and `error.details` lists what was found; archive it instead where an archive verb exists. Deleting is not a GDPR erasure: erasure is handled separately and respects legal hold.