Infronest REST API

Each tenant is served from its own workspace subdomain, and the API lives directly under it:

https://<workspace>.infronest.com/api/

Replace <workspace> with your workspace slug (the one derived from your company name at sign-up). All requests and responses are JSON. The schema itself is served by drf-spectacular and rendered as interactive Swagger UI and ReDoc inside the app for administrators at /api/docs/ and /api/redoc/.

Infronest uses JSON Web Tokens (SimpleJWT). Exchange your workspace credentials for an access and a refresh token, then send the access token as a bearer header on every call:

Authorization: Bearer <access_token>

Access tokens are short-lived (60 minutes by default); refresh tokens last up to 7 days and are rotated on use. A successful login returns both tokens plus the signed-in user’s profile:

POST /api/auth/login/
{ "username": "you@company.com", "password": "••••••••" }

200 OK
{
  "access":  "eyJhbGciOiJIUzI1NiIs…",
  "refresh": "eyJhbGciOiJIUzI1NiIs…",
  "user": {
    "id": 42,
    "email": "you@company.com",
    "role": "SUPER_ADMIN",
    "role_display": "Super Admin",
    "department": "IT",
    "permissions": [ … ]
  }
}

When a user has two-factor authentication enabled, the login response withholds the tokens and returns totp_required: true with a short-lived pre-auth token; the caller completes the second factor before receiving JWTs. Refresh with POST /api/auth/refresh/, check a token with POST /api/auth/verify/, and revoke a session (blacklisting the refresh token) with POST /api/auth/logout/.

Browser sessions can also run in httpOnly-cookie mode, and device agents authenticate with their own enrollment token (Authorization: DeviceToken <token>) — the schema advertises all of these security schemes.

• Resource-oriented. Most resources are standard collections: GET to list, POST to create, GET /{id}/ to retrieve, PATCH/PUT to update, DELETE to remove — with custom actions like /{id}/acknowledge/ or /{id}/launch/ hung off the resource.
• Pagination. List endpoints are paginated (page number, 50 items per page by default) and wrap results as { count, next, previous, results }. Pass ?page=N to page through.
• Tenant isolation. Every response is scoped to the organization of the authenticated caller. There is no cross-tenant access — you only ever see your own workspace’s data.
• Caching. Some GET responses are cached briefly server-side for performance; writes return fresh data.

The API spans roughly forty modules and over a thousand routes. Below are the primary top-level groups with a couple of real endpoints each; the modules your workspace can call depend on your plan.

List the first page of tickets in your workspace with a bearer token:

curl https://<workspace>.infronest.com/api/tickets/ \
  -H "Authorization: Bearer <access_token>"

200 OK
{
  "count": 128,
  "next": "https://<workspace>.infronest.com/api/tickets/?page=2",
  "previous": null,
  "results": [ { "id": 1, "subject": "…", "status": "open", … } ]
}

New to the platform? Start with the documentation for workspace setup, roles, and module configuration.