Download PDF

API Access

SmoovOps can be called directly from your own scripts, CI pipelines, or tools like Zapier — without a browser session — using a Personal API Token.

What a Personal API Token is

A Personal API Token (PAT) is a secret credential, starting with smv_live_, that identifies you and your account to the SmoovOps API. It works the same way a login session does — anything you can do in the app, a request carrying your token can do too — so treat it like a password: don't share it, and don't commit it to source control.

Alongside your token, SmoovOps also gives you an API key. This is one fixed value per account (not per token) that the API uses to apply rate limits and daily quotas. You'll get your API key the first time you generate a token; every token you generate afterwards reuses the same key.

The two required headers

Every direct API request must include both of the following headers:

Authorization: Bearer smv_live_...
x-api-key: <your API key>

The Authorization header identifies you; the x-api-key header is what the API checks against your account's rate limit and daily quota.

Generating a token Starter+

  1. Go to Settings, under the Company tab (visible to the account Owner or an Admin only).
  2. Under API Tokens, select Generate new token.
  3. Give it a name — something that reminds you what it's for, e.g. "CI pipeline" or "Zapier" — and optionally an expiry date.
  4. Select Generate. A dialog shows your new token and your account's API key, exactly once. Copy both now — SmoovOps never shows the full token again after this.

If you lose a token, you can't recover it — revoke it and generate a new one instead.

Revoking a token

In the same API Tokens table, select Revoke next to a token, then confirm. This is permanent — if you revoke a token by mistake, generate a new one.

Revoking isn't instant everywhere: a request already in flight, or one made within a few minutes of revoking, may still succeed briefly. Changes may take a few minutes to take effect.

Rate limits and quotas

How many requests per second, and per day, your tokens can make depends on your plan — Pro accounts get a higher rate limit and daily quota than Starter. Requests over your daily quota, or too many requests too quickly, receive an error response until the limit resets. Contact the SmoovOps support team if your integration needs a higher limit than your plan provides.

Who can access the API

API access is available on the Starter and Pro plans. It isn't available on the Free plan — upgrade from Settings to unlock it.

Endpoint reference

Once you have a token, see the API Reference for the full list of endpoints and what each one expects in its request body.

Postman collection

To start firing real requests right away instead of building them by hand, SmoovOps publishes a ready-to-use Postman collection and environment — plus a standalone copy of the API Reference — in the public smoovops-api repository on GitHub. The collection covers every endpoint your token can actually call, grouped by resource, with an example request body already filled in — together with the API Reference, it's everything you need to go from "I have a token" to a working request in a couple of minutes.

  1. Open the repository and download (or clone) it — it contains the two Postman files plus api-reference.md.
  2. In Postman, select Import and add both JSON files.
  3. Select the SmoovOps API environment (top right) and fill in apiToken and apiKey with the values you copied when generating your token above. baseUrl already points at the production API.
  4. Open any request and select Send — the token and key apply automatically to every request in the collection.

Optional query parameters — paging (limit, page), filters such as partnerId, or the key/fileId of a file download — are already listed on each request's Params tab, prefilled with their default where there is one, but switched off. Tick the ones you need.

The collection intentionally leaves out registration/login, newsletter, and webhook endpoints, plus API token management itself — none of those accept a Personal API Token (they're either public, third-party-signed, or, for token management, deliberately blocked to stop a leaked token from minting or revoking tokens on its own). See the API Reference for those, if needed, from a browser session instead.

Found an issue with a request in the collection, or think an endpoint is missing? Open an issue on the repository — it's kept in sync with this reference by hand, so a report is the fastest way to get it fixed.