Endpoint reference

Every route, and the scope it needs. This table is generated from the routes the API actually serves, so it cannot describe an endpoint that does not exist or omit one that does.

Endpoint	Scope required	Filters
`GET /api/v1/assets` `GET /api/v1/assets/{id}`	`assets:read`	`category`, `location_id`, `status`
`GET /api/v1/handovers` `GET /api/v1/handovers/{id}`	`handovers:read`	`location_id`, `status`
`GET /api/v1/learning-assignments` `GET /api/v1/learning-assignments/{id}`	`learning:read`	—
`GET /api/v1/locations` `GET /api/v1/locations/{id}`	`locations:read`	—
`GET /api/v1/people` `GET /api/v1/people/{id}`	`people:read`	`location_id`
`GET /api/v1/purchase-requests` `GET /api/v1/purchase-requests/{id}`	`approvals:read`	`location_id`
`GET /api/v1/systems` `GET /api/v1/systems/{id}`	`systems:read`	`category`, `location_id`, `status`
`GET /api/v1/tasks` `GET /api/v1/tasks/{id}`	`tasks:read`	`location_id`
`GET /api/v1/transitions` `GET /api/v1/transitions/{id}`	`transitions:read`	`location_id`, `status`
`GET /api/v1/vendors` `GET /api/v1/vendors/{id}`	`vendors:read`	`category`, `location_id`, `status`
`GET /api/v1/workplace-records` `GET /api/v1/workplace-records/{id}`	`workplace:read`	`location_id`, `record_type`, `status`

Common parameters

Every list accepts:

limit — 1 to 1000, default 100
cursor — the next_cursor from the previous page
updated_since — an ISO 8601 timestamp; returns only records changed after it

Where a register supports text search it also accepts search. Per-endpoint filters are in the table above; a value outside the set an endpoint accepts is a 400 rather than an empty page.

Scopes

Scope	Covers	What it reads
`vendors:read`	Vendors & Renewals	Subscriptions, contracts, owners, spend, seats and renewal dates.
`approvals:read`	Requests & Approvals	Purchase requests, their approvers and the decisions taken on them.
`systems:read`	Systems & Access	Business systems, their owners and who holds access to each.
`learning:read`	Learning & Compliance	Published content, assignments and acknowledgement evidence.
`handovers:read`	Handover & Continuity	Holiday, shift and role handovers with their items and recipients.
`transitions:read`	Employee Transitions	Joiner and leaver checklists and what each person still holds.
`assets:read`	Assets & Maintenance	Equipment, assignments, custody history and warranty dates.
`workplace:read`	Workplace Operations	Workplace records and the people they concern.
`people:read`	People	The employee directory: names, work contact details, roles and teams.
`locations:read`	Locations	Sites, departments and teams.
`tasks:read`	Tasks	Work generated by handovers and learning assignments.

The machine-readable contract

/developers/openapi.json describes this surface as OpenAPI, and is generated from the same routes. Use it to build a client rather than typing one out.

It describes /api/v1 only. kitset's own browser client talks to other endpoints; those are internal, they change without notice, and they are not part of this contract.