Connect an integration or a script to TekStacks: an RMM that keeps equipment up to date, a report that pulls your employees, a script that hands out loaners.

Overview

The TekStacks API is at https://api.tekstacks.com/v1. Every request carries an API token, which decides the company, what it may see and change, and for an MSP which clients. Each token has its own permissions, chosen from the stacks (equipment, employees and the rest); a token can never manage users, roles, settings or billing, and never reaches the Vault or license keys.

Anything a token changes is recorded in Activity under its name, with the actor API. Nothing can be deleted through the API.

Requirements

• Role: Admin (Company settings, custom domain and storage).

Steps

Make a token

1. In the sidebar, open Administration, then API tokens.
2. Click Make a token.
3. Give it a Name that says what uses it, such as RMM sync.
4. Tick the Permissions it needs, and nothing more. Adding or editing includes seeing.
5. For an MSP, choose Clients: all clients, or one.
6. Choose when it Expires: in 30 days, 90 days, a year, or never.
7. Confirm your password (or your passkey, if you sign in with passkeys only) and click Make token.
8. Copy the token and store it in your integration's secret settings. It starts with tks_ and is shown only once.

Every Admin is emailed when a token is made, rotated or revoked.

Send your first request

Send the token in the Authorization header. This asks who the token is:

curl https://api.tekstacks.com/v1/me \
  -H "Authorization: Bearer tks_your_token_here"

The answer names the token, your company, its permissions, its client, when it expires and which parts of TekStacks your account includes:

{
  "data": {
    "id": "tok_aB3xK9pQRn",
    "object": "token",
    "name": "RMM sync",
    "company": { "id": "ten_Qm7Hc2WvLe", "name": "Acme IT" },
    "permissions": ["assets.view", "assets.update"],
    "client": null,
    "expires_at": "2027-10-16T14:03:00Z",
    "features": ["network", "documentation"]
  }
}

Then list equipment:

curl "https://api.tekstacks.com/v1/equipment?limit=50" \
  -H "Authorization: Bearer tks_your_token_here"

Page through a list

Lists are sorted by id and come a page at a time: 25 records, or up to 100 with ?limit=. Each answer says whether there is more in has_more, and links.next is the address of the next page, with your filters kept and starting_after set to the last id on this page:

{
  "data": [ { "id": "ast_aB3xK9pQRn", "object": "asset" }, { "id": "ast_bC4yL2qRSt", "object": "asset" } ],
  "has_more": true,
  "links": {
    "next": "https://api.tekstacks.com/v1/equipment?limit=2&starting_after=ast_bC4yL2qRSt",
    "prev": null
  }
}

Keep requesting links.next until it is null. To go back a page, links.prev uses ending_before with the first id on the page. An id that is not in the list, such as one from another list, is refused with 422.

Keep a copy in sync

Add ?updated_since= with a time in ISO 8601 (for example 2026-10-16T00:00:00Z) to get only what changed since then, and page through it the same way. Save the time you started each sync and pass it next time:

curl "https://api.tekstacks.com/v1/employees?updated_since=2026-10-16T00:00:00Z&limit=100" \
  -H "Authorization: Bearer tks_your_token_here"

Records are never deleted through the API; someone who left shows as "status": "left" and disposed equipment carries its disposal, so a sync sees the change rather than a gap.

Look up every endpoint

The API reference lists every endpoint with its fields, filters, the permission it needs, and an example request and answer for each, in curl, JavaScript, PHP and Python. It also offers the OpenAPI file (openapi.yaml) and a Postman collection (collection.json) to import into your own tools.

Change records

Send JSON with POST to add and PATCH to change only the fields you send. Records are named by their id, such as "location": "loc_7Kx2mPqRtw"; the lists at /v1/locations, /v1/statuses, /v1/types and the others give you the ids to use. Actions have their own address, such as POST /v1/equipment/{id}/assign with an employee.

For an MSP token for all clients, add "client": "org_..." when adding a record. Add an Idempotency-Key header with a value of your own to a create, and sending it again within 24 hours returns the first result instead of a second record.

Rotate a token

Give a token a new secret, for example on a schedule or when someone who knew it leaves. It stays the same token: its permissions, clients, expiry and history do not change.

1. On API tokens, click the rotate icon on the token's row.
2. Choose when The old secret stops working: now, in 1 hour, in 24 hours or in 7 days.
3. Confirm your password (or your passkey) and click Rotate.
4. Copy the new secret, shown only once, and put it in your integration.

Until the time you chose, both the old and the new secret work, so the integration can switch without a gap. The row shows when it was rotated and until when the old secret works; after that the old secret is refused with 401.

Revoke a token

On API tokens, click the revoke icon on the token's row and confirm. Anything using it, including an old secret still in its overlap after a rotation, is refused from its next request. To change a token's permissions or clients, make a new token and revoke the old one. The rename icon changes only its name.

Notes

Note: A token can make 120 requests a minute. Past that the API answers 429 with a Retry-After header saying how many seconds to wait.

When a request is refused, the answer says why in message:

Status	Meaning
401	The token is missing, unknown, expired or revoked.
403	The token lacks a permission, or your account does not include that part of TekStacks. The message names which.
404	No such record, or one the token cannot see.
409	The record's state does not allow it, such as changing disposed equipment.
422	Something in the request is not valid; errors lists each field.

FAQ

Can a token see every client? Only if it was made for all clients. A token for one client sees and changes only that client's records.

What happens when a token expires? Requests with it are refused. It stays listed, marked, so you can see what it was; make a new one to replace it.

Can I get a token for myself? Tokens belong to the company and are made by Admins. Each one is listed with who made it and when it was last used. To have an AI assistant act as you, connect it instead: see AI assistants.