The objects the Platform API sends and receives.
An API key. The secret is never returned after creation.
-
id
string
The key's id, key_….
Example key_0192a4c3e5f67b8d9e0f1a2b3c4d5e6f
-
name
string
What the key is for.
Example Fleet dashboard
-
scopes
string[]
The scopes the key may use.
Example ["iot.sims:read","iot.usage:read"]
-
status
string
active, expired or revoked.
Example active
-
allowedIpRanges
string[]
Source addresses and CIDR ranges the key is limited to; empty for anywhere.
Example ["203.0.113.0/24"]
-
createdAt
string (date-time)
Example 2026-09-25T10:00:00Z
-
expiresAt
string (date-time)
Example 2027-09-25T10:00:00Z
-
lastUsedAt
string (date-time) or null
When the key was last used, to the nearest few minutes; null if never.
Example 2026-09-25T11:30:00Z
-
revokedAt
string (date-time) or null
When the key was revoked; null unless it has been.
A new API key.
-
name
string
required
What the key is for, so you can recognise it later.
Example Fleet dashboard
-
scopes
string[]
required
The scopes the key may use. Each must be one the calling credential holds itself: a key
can never do more than the key that created it.
Example ["iot.sims:read","iot.usage:read"]
-
expiresAt
string (date-time) or null
When the key stops working, at most a year ahead (and no later than the calling key's own
expiry). Leave out for a year.
Example 2027-03-31T00:00:00Z
-
allowedIpRanges
string[] or null
Limit the key to these source addresses or CIDR ranges. Leave out for anywhere — unless the
calling key is itself limited, in which case the new key inherits its limits and may only
narrow them.
Example ["203.0.113.0/24"]
A created key and its secret.
-
An API key. The secret is never returned after creation.
-
secret
string
The key itself — send it as Authorization: Bearer …. Shown only in this response: store
it now; it cannot be read back.
Example eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.…
The organisation's API keys.
API response model for organisation branding information
Includes inline SVG logo content for authenticated users and extensions
-
organisationId
string (uuid)
Organisation ID that owns this branding
-
organisationName
string or null
Organisation name to display in the application
-
primaryColor
string or null
Primary brand color (hex format, e.g., #5A66F1)
-
secondaryColor
string or null
Secondary brand color (hex format, e.g., #60A5FA)
-
supportPhone
string or null
Support contact phone number
-
supportEmail
string or null
Support contact email address
-
logoSvg
string or null
SVG logo content inline (full SVG markup)
-
isInherited
boolean
Indicates if this branding is inherited from a parent organisation
Standard API response envelope for success responses
The response of GET /api/v1/platform/users.
A portal user of your own organisation or one below it (GET /api/v1/platform/users) —
enough to check who someone is, never a credential.
-
id
string
-
name
string
-
email
string or null
-
organisationId
string (uuid)
-
invitationPending
boolean
The account has never been used — no sign-in recorded — so, for a user of one of your own
customers, POST …/users/{id}/invitation can send it a fresh invitation.
-
lastSignInUtc
string (date-time) or null
When the user last signed in; null if they never have.
One customer organisation the caller can reach (GET /api/v1/platform/customers).
A page of results. Follow nextCursor for the next one.
-
This page of results.
-
hasMore
boolean
required
Whether another page follows.
Example true
-
nextCursor
string or null
Pass as startingAfter to get the next page. Null on the last page.
Example c2ltXzg5NDQxMTAwNjgyMTIzNDU2Nzg
A registered device.
-
id
string (uuid)
The registration's id — the one to deregister it with.
Example 0192a4c3-e5f6-7b8d-9e0f-1a2b3c4d5e6f
-
deviceId
string
Example 6f1c2d3e-4a5b-4c7d-8e9f-0a1b2c3d4e5f
-
The mobile operating system a device runs, which decides how it is pushed to.
One of ios android
-
isNewRegistration
boolean
True when this call created the registration; false when it updated one.
Example true
The mobile operating system a device runs, which decides how it is pushed to.
ios android
Register this device for notifications, or refresh its push token. Registering the same
deviceId again updates the existing registration rather than adding one.
-
deviceId
string
required
A stable identifier for this installation, generated by the app and kept for its lifetime
(it survives token rotation, not a reinstall).
Example 6f1c2d3e-4a5b-4c7d-8e9f-0a1b2c3d4e5f
-
The mobile operating system a device runs, which decides how it is pushed to.
One of ios android
-
pushToken
string
required
The APNs device token (iOS) or FCM registration token (Android).
Example 80f4c2b9e1d3a5c7f9e1b3d5a7c9e1f3b5d7a9c1e3f5b7d9a1c3e5f7b9d1a3c5
-
appVersion
string or null
Example 1.0.42
-
deviceModel
string or null
Example iPhone 15 Pro
-
deviceName
string or null
The name the user gave the device, if the app shares it.
Example Sam's iPhone
-
osVersion
string or null
Example iOS 18.1
Standard API response for error cases
A page of results. Follow nextCursor for the next one.
-
This page of results.
-
hasMore
boolean
required
Whether another page follows.
Example false
-
nextCursor
string or null
Pass as startingAfter to get the next page. Null on the last page.
The oldest app build the server still supports, per platform, as a dotted version. An app below
it shows a blocking “update required” screen. “0.0.0” means no minimum.
-
ios
string
-
android
string
Ways a notification can reach a customer.
webhook email portal
One push notification event and whether the user receives it.
Every push notification event, with the user's current choice.
Turn push notification events on or off. Events not listed are left as they are.
One entry in the notification catalogue.
-
type
string
required
Example iot.sim.allowance_reached
-
The product area a notification belongs to; platform is the account itself.
One of voice connectivity hosting iot support platform
-
description
string
required
Example A SIM used its whole data allowance for the period and has stopped passing data.
-
optIn
boolean
required
High-volume types are only sent to webhooks that name them in types.
Example false
-
available
boolean
required
False for a type that is catalogued (so it can be subscribed to and documented) but not yet
raised by anything. Subscribing to it is allowed; nothing arrives until it is.
Example true
-
One of webhook email portal
-
examplePayload
object
required
An example of the type's data object.
The notification catalogue, filtered to the service areas your account has.
Which access email was sent.
passwordReset invitation
The answer of POST …/users/{id}/password-reset and …/invitation: the email went to
the address on the account. It never carries the link or its token.
-
userId
string
-
Which access email was sent.
One of passwordReset invitation
-
sentAtUtc
string (date-time)
An RFC 9457 problem document. type and code are stable; title and
detail are for people.
-
type
string
Identifies the kind of problem.
Example https://partners.netavo.com/api/problems/not-found
-
title
string
Short, human-readable summary of the problem type.
Example Not found
-
status
integer
The HTTP status code.
Example 404
-
detail
string or null
What went wrong with this request.
Example No SIM with ICCID 8944110068212345678 in your account.
-
instance
string or null
The request path.
Example /api/v1/iot/sims/8944110068212345678
-
code
string
Stable machine-readable code, the last segment of type.
Example not-found
-
traceId
string or null
Quote this if you contact support.
Example 00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01
-
errors
map of string[] or null
Per-field messages when code is validation-failed.
The caller's effective white-label branding, for the app's theme overlay.
-
organisationId
string (uuid)
-
portalName
string or null
-
primaryColor
string or null
-
secondaryColor
string or null
Feature switches for the caller. Each is true when the caller holds a role that grants it
(system administrators hold all). A true flag says the feature may be offered, not that every
call will succeed — tenant scope is still enforced per request.
-
billing
boolean
-
tickets
boolean
-
ticketsSupplierInbox
boolean
The “customer tickets” inbox: tickets the caller's organisation supplies.
-
ticketsCreate
boolean
Raising a ticket (POST /api/v1/support/tickets): the tickets-manage role.
-
orders
boolean
-
broadband
boolean
-
broadbandDiagnostics
boolean
-
sims
boolean
-
availability
boolean
-
availabilityPricing
boolean
-
singleLines
boolean
Single lines: list, detail, call history and recordings, label edits.
-
phoneSystems
boolean
Phone systems (read-only): extensions, numbers, ring groups, queues and IVRs.
-
manageSingleLines
boolean
May change a single line's label and customer reference.
-
revealSingleLineCredentials
boolean
May reveal a single line's SIP password (audited).
-
revealExtensionCredentials
boolean
May reveal a phone system extension's SIP password (audited).
-
playRecordings
boolean
May play call recordings and read transcripts (voice.phonesystems.recordings.view
or .manage). Without it a call's metadata is still shown, with no recording URL.
GET /api/v1/platform/me — who the caller is and what they may do. The Beacon Partner app
calls it at start-up and on every token refresh to build its navigation, so a role granted or
removed in the portal shows or hides a feature without a reinstall. Capabilities are computed on
the server from the caller's roles; a client never parses role claims itself.
-
The signed-in user; null for a credential with no user behind it (an API key).
-
-
Feature switches for the caller. Each is true when the caller holds a role that grants it
(system administrators hold all). A true flag says the feature may be offered, not that every
call will succeed — tenant scope is still enforced per request.
-
The caller's effective white-label branding, for the app's theme overlay.
-
The oldest app build the server still supports, per platform, as a dotted version. An app below
it shows a blocking “update required” screen. “0.0.0” means no minimum.
The signed-in user; null for a credential with no user behind it (an API key).
-
id
string
-
name
string or null
-
email
string or null
A new signing secret. Events are signed with both secrets until previousSecretExpiresAt.
-
signingSecret
string
required
Example whsec_9pD2kR5tV8xA1cF4hJ7mN0qS3uW6yZ9b
-
previousSecretExpiresAt
string (date-time)
required
Events are signed with both secrets until then.
Example 2026-09-26T09:30:00Z
The product area a notification belongs to; platform is the account itself.
voice connectivity hosting iot support platform
The test event that was queued.
A webhook endpoint.
-
id
string
required
The webhook's id, wh_….
Example wh_0192a4c3e5f67b8d9e0f1a2b3c4d5e6f
-
organisationId
string (uuid)
required
The organisation that owns the webhook.
Example 0f8b6c1e-5a2d-4c7e-9b3a-2d1e6f4a7c90
-
url
string
required
Where we POST events. HTTPS on a public address; redirects are not followed.
Example https://example.com/hooks/thingsim
-
description
string or null
Example Ops alerts
-
types
string[]
required
Notification types to send. Empty with empty serviceAreas means every type your account
can receive, except opt-in types.
Example ["iot.sim.allowance_reached","iot.sim.usage_threshold"]
-
Send every type in these service areas.
One of voice connectivity hosting iot support platform
-
includeSubtree
boolean
required
Partners: also send events for customer organisations below you.
Example false
-
enabled
boolean
required
Example true
-
status
string
required
active, failing while deliveries are being retried, or disabled (switched off, or
after a day of failures).
Example active
-
disabledReason
string or null
Why a disabled webhook was switched off.
-
createdAt
string (date-time)
required
Example 2026-09-20T10:00:00Z
-
updatedAt
string (date-time)
required
Example 2026-09-20T10:00:00Z
A new webhook endpoint.
-
url
string
required
Where we POST events. HTTPS on a public address; redirects are not followed.
Example https://example.com/hooks/thingsim
-
description
string or null
Example Ops alerts
-
types
string[] or null
Notification types to send. Leave out (with serviceAreas) for every type your account can
receive, except opt-in types.
Example ["iot.sim.allowance_reached","iot.sim.usage_threshold"]
-
Send every type in these service areas.
One of voice connectivity hosting iot support platform
-
includeSubtree
boolean or null
Partners: also send events for customer organisations below you. Null or left out is false.
Example false
-
organisationId
string (uuid) or null
Partners: create the webhook for a customer organisation below you. Defaults to your own
organisation.
The new webhook and its signing secret. The secret is only ever returned here and by
rotate-secret: store it now.
-
A webhook endpoint.
-
signingSecret
string
required
Verifies the Webhook-Signature header.
Example whsec_3yJ8mQ2vN6pR9tW1zC4fH7kL0sX5bE8g
One attempt to deliver an event to a webhook.
-
id
string
required
This attempt, dlv_…. Pass it to redeliver the event.
Example dlv_0192a4c3e5f67b8d9e0f1a2b3c4d5e71
-
eventId
string
required
Example evt_0192a4c3e5f67b8d9e0f1a2b3c4d5e72
-
eventType
string
required
Example iot.sim.allowance_reached
-
attempt
integer
required
Example 1
-
outcome
string
required
succeeded, failed or pending (queued, not yet attempted).
Example succeeded
-
responseStatus
integer or null
Your endpoint's HTTP status; null if it could not be reached.
Example 200
-
durationMs
integer
required
Example 184
-
error
string or null
-
attemptedAt
string (date-time)
required
Example 2026-09-25T09:12:45Z
-
nextAttemptAt
string (date-time) or null
When a failed delivery will be retried.
A page of results. Follow nextCursor for the next one.
-
This page of results.
-
hasMore
boolean
required
Whether another page follows.
Example false
-
nextCursor
string or null
Pass as startingAfter to get the next page. Null on the last page.
The body of every webhook POST, and an item in the event log. data depends on type: see the
notification catalogue.
-
id
string
required
evt_…. Unique per event; deliveries can repeat, so de-duplicate on it.
Example evt_0192a4c3e5f67b8d9e0f1a2b3c4d5e72
-
type
string
required
The notification type.
Example iot.sim.allowance_reached
-
The product area a notification belongs to; platform is the account itself.
One of voice connectivity hosting iot support platform
-
organisationId
string (uuid)
required
The organisation the event is about.
Example 0f8b6c1e-5a2d-4c7e-9b3a-2d1e6f4a7c90
-
occurredAt
string (date-time)
required
When the change took effect.
Example 2026-09-25T09:12:44Z
-
data
object
required
The type's payload; see the notification catalogue.
Example {"iccid":"8944110068212345678","label":"Car park barrier 3","planId":"5b0e4f2a-8c1d-4e6f-9a3b-7d2c1e0f4a61","allowanceBytes":1073741824,"usedBytes":1073741824,"periodEnd":"2026-10-01T00:00:00Z"}
A page of results. Follow nextCursor for the next one.
-
This page of results.
-
hasMore
boolean
required
Whether another page follows.
Example false
-
nextCursor
string or null
Pass as startingAfter to get the next page. Null on the last page.
Fields to change. Leave a field out to keep it.
-
url
string or null
Where we POST events. HTTPS on a public address; redirects are not followed.
Example https://example.com/hooks/thingsim
-
description
string or null
Example Ops alerts
-
types
string[] or null
Replaces the types sent.
Example ["iot.sim.allowance_reached"]
-
Replaces the service areas sent.
One of voice connectivity hosting iot support platform
-
includeSubtree
boolean or null
Example false
-
enabled
boolean or null
Re-enabling a disabled webhook resets its failure count.
Example true