Use ITFlow's API to work with ITFlow in scripts and third-party applications.

The current version of the ITFlow API is v1. It can be accessed at itflow.example.com/api/v1/{module}/{function}.php

We are in the process of creating dedicated API documentation accessible at: https://developer.itflow.org

1. Login and navigate to the Admin Settings page
2. Select API Keys
3. Select Create to open the New Key modal
4. On Details tab, input the key name and expiration date. Select whether the key will allow access to all clients or a specific client
5. On Keys tab, note down the API key and credential password and select the checkbox to confirm you've made a copy of the keys. You will not see these again in the admin interface.
6. Select Create to add the key into the database

• assets
• certificates
• clients
• contacts
• credentials (logins)
• documents
• domains
• expenses
• invoices
• invoice_items
• locations
• networks
• payments
• products
• quotes
• software
• tickets
• vendors

• read
• create (partial - see module details)
• update (partial - see module details)
• delete (partial - see module details)
• archive (clients and contacts only)
• unarchive (clients and contacts only)
• resolve (tickets only)

• GET - Retrieving (READ) data
• POST - Inserting (CREATE), Updating (UPDATE), Deleting (DELETE), or Archiving data

• Success - True/False
• Message - Failure info / Helpful debug info
• Count - Count of rows affected/returned
• Data - The data requested/created/changed

• For read requests, 50 records are shown by default. This can be adjusted by supplying the limit and offset parameters.
• For POST requests, the client_id parameter is always required if the API key used has scope/access to all clients
• Be sure to check your Apache/PHP error logs if you're running into issues
• To prevent your server from accidentally logging API keys, see here

Current API v1 Endpoints, Authentication, Examples, and Integration Guide

1. Generate API Key
   1. Login to ITFlow as admin
   2. Navigate to Admin > API
   3. Click New Key
   4. Choose scope: All Clients (for testing) or Specific Client
   5. Copy the generated key

1. Test Connection

curl "https://itflow.yourdomain.com/api/v1/clients/read.php?api_key=YOUR_KEY&limit=1"

1. Expected Response

{
  "success": "True",
  "count": 1,
  "data": [{"client_id": "123", "client_name": "Example Corp"}]
}

• Base URL: /api/v1/{module}/{function}.php
• Version: 1.0 (current)
• Authentication: API Key via query parameter ?api_key=YOUR_KEY
• Response Format: JSON with success, message, count, data fields
• Pagination: Default 50 records, adjustable with limit and offset parameters
• Content-Type: application/json for POST requests
• Character Encoding: UTF-8 (utf8mb4 in database)

{
  "success": "True|False",
  "message": "Descriptive status message",
  "count": 50,
  "data": [
    {
      "id": 123,
      "field": "value"
    }
  ]
}

{
  "success": "True",
  "count": "1",
  "data": [
    {
      "insert_id": 123
    }
  ]
}

• Generation: Admin > API > New Key
• Scoping Options:
  • All Clients (client_id = 0): Full access to all client data
  • Specific Client: Limited to single client data only
• Usage: Query parameter ?api_key=YOUR_KEY for GET, or in JSON body for POST
• Security: Keys stored encrypted in database with expiration dates

• Rotate keys regularly (monthly recommended)
• Use client-scoped keys for third-party integrations
• Store keys securely (environment variables, not code)
• Monitor usage via Apache/PHP logs
• Use HTTPS only for all API calls

Purpose: Computer and equipment inventory management

Available Endpoints:

• GET /read.php - List/get asset information
• POST /create.php - Create new asset record
• POST /update.php - Update existing asset
• POST /delete.php - Delete asset record

Read Parameters (GET):

Create/Update Parameters (POST):

Update Additional Parameters:

Delete Parameters:

<wrap em>Note: Deleting an asset also removes all associated network interfaces.</wrap>

Example - Create Asset:

curl -X POST "https://itflow.example.com/api/v1/assets/create.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "client_id": 1,
    "asset_name": "DESKTOP-001",
    "asset_type": "Desktop",
    "asset_make": "Dell",
    "asset_model": "OptiPlex 7090",
    "asset_serial": "ABC123XYZ",
    "asset_os": "Windows 11 Pro",
    "asset_ip": "192.168.1.100",
    "asset_mac": "00:11:22:33:44:55",
    "asset_status": "Deployed"
  }'

Purpose: SSL/TLS certificate management and expiration tracking

Available Endpoints:

• GET /read.php - List/get certificate information
• POST /create.php - Create certificate record

<wrap em>Note: Update and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Create Parameters (POST):

Purpose: Customer/company management

Available Endpoints:

• GET /read.php - List/get client information
• POST /create.php - Create new client
• POST /update.php - Update client details
• POST /archive.php - Archive client
• POST /unarchive.php - Unarchive client

<wrap em>Note: Delete endpoint is not implemented. Use archive instead.</wrap>

Read Parameters (GET):

Create Parameters (POST):

<wrap em>Important: Creating clients requires an API key with “All Clients” scope (client_id = 0).</wrap>

Update Additional Parameters:

Archive/Unarchive Parameters:

<wrap em>Note: Archiving a client automatically stops all recurring invoices for that client.</wrap>

Purpose: Individual contact management within client organizations

Available Endpoints:

• GET /read.php - List/get contact information
• POST /create.php - Create new contact
• POST /update.php - Update contact details
• POST /delete.php - Delete contact record
• POST /archive.php - Archive contact
• POST /unarchive.php - Unarchive contact

Read Parameters (GET):

Create Parameters (POST):

<wrap em>Note: Setting contact_primary = 1 will remove primary flag from other contacts for that client.</wrap>

Update Additional Parameters:

Delete Parameters:

Archive/Unarchive Parameters:

<wrap em>Note: Archiving a contact also archives their associated user account if one exists.</wrap>

Purpose: Password and login management (encrypted storage)

Available Endpoints:

• GET /read.php - List/get credential information
• POST /create.php - Create new credential record
• POST /update.php - Update credential details

<wrap em>Note: Delete endpoint is not implemented.</wrap>

<wrap em>Important: The api_key_decrypt_password parameter is required for ALL credential operations.</wrap>

Read Parameters (GET):

Create Parameters (POST):

Update Additional Parameters:

<wrap em>Note: Updating the password field automatically updates the password_changed_at timestamp.</wrap>

Purpose: Internal documentation and knowledge base articles

Available Endpoints:

• GET /read.php - List/get document information
• POST /create.php - Create new document
• POST /update.php - Update document

<wrap em>Note: Delete endpoint is not implemented.</wrap>

Read Parameters (GET):

Create Parameters (POST):

Update Additional Parameters:

Purpose: Domain name management and renewal tracking

Available Endpoints:

• GET /read.php - List/get domain information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Response Fields:

Purpose: Track business expenses

Available Endpoints:

• GET /read.php - List/get expense information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

<wrap em>Important: Expenses require an API key with “All Clients” scope.</wrap>

Read Parameters (GET):

Purpose: Access invoice records

Available Endpoints:

• GET /read.php - List/get invoice information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Purpose: Retrieve line items associated with invoices

Available Endpoints:

• GET /read.php - List/get invoice line items

curl "https://itflow.example.com/api/v1/invoice_items/read.php?api_key=YOUR_KEY&invoice_id=101"

{
  "success": "True",
  "count": 2,
  "data": [
    {
      "item_id": "184",
      "item_name": "make pizza",
      "item_description": "Do it",
      "item_quantity": "1.00",
      "item_price": "100.00",
      "item_subtotal": "100.00",
      "item_tax": "0.00",
      "item_total": "100.00",
      "item_order": "1",
      "item_tax_id": "0",
      "item_product_id": "0",
      "item_invoice_id": "101",
      "item_created_at": "2026-03-10 13:11:30",
      "item_updated_at": null,
      "item_archived_at": null
    }
  ]
}

Purpose: Manage client office/site locations

Available Endpoints:

• GET /read.php - List/get location information
• POST /create.php - Create new location

<wrap em>Note: Update and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Create Parameters (POST):

<wrap em>Note: Setting location_primary = 1 will remove primary flag from other locations for that client.</wrap>

Purpose: Network infrastructure documentation

Available Endpoints:

• GET /read.php - List/get network information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Purpose: Access payment records

Available Endpoints:

• GET /read.php - List/get payment information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

<wrap em>Important: Payments require an API key with “All Clients” scope.</wrap>

Read Parameters (GET):

Purpose: Access product/service catalog

Available Endpoints:

• GET /read.php - List/get product information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

<wrap em>Important: Products require an API key with “All Clients” scope.</wrap>

Read Parameters (GET):

Purpose: Access sales quote records

Available Endpoints:

• GET /read.php - List/get quote information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Purpose: Software license and application tracking

Available Endpoints:

• GET /read.php - List/get software information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Purpose: Help desk and issue tracking

Available Endpoints:

• GET /read.php - List/get ticket information
• POST /create.php - Create new ticket
• POST /resolve.php - Resolve/close ticket

<wrap em>Note: Update and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Create Parameters (POST):

<wrap em>Note: Ticket number is auto-generated based on system settings. Ticket source is set to “API”.</wrap>

Resolve Parameters (POST):

<wrap em>Note: Resolving sets status to Resolved and records the resolution timestamp. Also sets first response time if not already set.</wrap>

Example - Create Ticket:

curl -X POST "https://itflow.example.com/api/v1/tickets/create.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "client_id": 456,
    "ticket_subject": "Printer offline",
    "ticket_details": "Office printer not responding to print jobs",
    "ticket_priority": "Medium"
  }'

Purpose: Manage vendor/supplier records

Available Endpoints:

• GET /read.php - List/get vendor information

<wrap em>Note: Create, update, and delete endpoints are not implemented.</wrap>

Read Parameters (GET):

Location: /api/v1/custom/

ITFlow supports custom API endpoints. Place custom PHP files in the custom directory to extend API functionality.

1. API Key Issues
   • Verify key is correct (copy/paste errors common)
   • Check key scope (client-specific vs all clients)
   • Confirm key hasn't expired

1. Permission Errors
   • Add client_id parameter for scoped keys
   • Verify client_id exists and is accessible

1. Server Errors
   • Check Apache/PHP error logs: /var/log/apache2/error.log
   • Verify ITFlow database connectivity
   • Check PHP memory limits for large requests

1. Data Issues
   • Validate required fields for POST requests
   • Check data types (strings, integers, dates)
   • Verify foreign key relationships exist
   • Ensure unique constraints aren't violated (e.g., contact email per client)

List All Clients:

$apiKey = "YOUR-API-KEY"
$baseUrl = "https://itflow.yourdomain.com"
$uri = "$baseUrl/api/v1/clients/read.php?api_key=$apiKey"
 
Invoke-RestMethod -Uri $uri | ConvertTo-Json

Create New Asset:

$uri = "https://itflow.yourdomain.com/api/v1/assets/create.php"
$body = @{
    "api_key" = "YOUR-API-KEY"
    "asset_name" = "Sample Laptop"
    "asset_type" = "Laptop"
    "asset_make" = "Dell"
    "asset_model" = "Latitude 5520"
    "client_id" = "1"
} | ConvertTo-Json
 
Invoke-RestMethod -Method Post -Uri $uri -Body $body -ContentType "application/json"

import requests
 
api_key = "YOUR_API_KEY"
base_url = "https://itflow.yourdomain.com/api/v1/"
 
# Get all clients
response = requests.get(f"{base_url}clients/read.php?api_key={api_key}")
data = response.json()
print(data)
 
# Create new ticket
ticket_data = {
    "api_key": api_key,
    "client_id": 456,
    "ticket_subject": "Network issue",
    "ticket_details": "Unable to access shared drive",
    "ticket_priority": "High"
}
 
response = requests.post(f"{base_url}tickets/create.php", json=ticket_data)
result = response.json()
print(result)

<?php
$api_key = 'YOUR_API_KEY';
$base_url = 'https://itflow.yourdomain.com/api/v1/';
 
// Get clients
$url = $base_url . 'clients/read.php?api_key=' . $api_key;
$response = file_get_contents($url);
$data = json_decode($response, true);
 
print_r($data);
?>

# Get all assets for a client
curl "https://itflow.example.com/api/v1/assets/read.php?api_key=YOUR_KEY&limit=10"
 
# Create a contact
curl -X POST "https://itflow.example.com/api/v1/contacts/create.php" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_KEY",
    "client_id": 1,
    "contact_name": "John Smith",
    "contact_email": "john@example.com",
    "contact_phone": "5551234567",
    "contact_primary": 1
  }'