Overview
The Mobaro API gives your own systems programmatic access to your organization's data. Typical uses are exporting Checklist Results to a data warehouse or BI tool such as Power BI, syncing Users, Locations and Assets with other systems, and creating or updating Assignments automatically.
The API follows REST conventions over HTTPS with JSON. Every endpoint lives under https://app.mobaro.com/api/customers. For low-code automation you may not need to write requests at all: see Getting started with Mobaro's Power Automate connector.
At a glance |
|
Who can do this | Users with Organization › Administrate create API keys. Your integration then calls the API with the key. |
Where | Configuration › API › API Keys |
Works on | Public API |
Availability | Enabled per organization by Mobaro — ask your CSM |
Check you have API access
API access is switched on per organization by Mobaro. When it's on, Users who can open Configuration (Organization › Administrate) see an API tab with an API Keys panel. If there is no API tab, or it only shows webhooks, ask your CSM to enable API access.
Mobaro can enable full access or read-only access. With read-only access, every key you create is read-only.
Create an API key
1. Open the API tab
In the Backend, go to Configuration › API. The API Keys panel lists your organization's keys.
2. Create and name the key
Click the + button (tooltip Create). In Configure API key, enter a name that says what the key is for. Read-only is ticked by default; read-only keys can't create, update or delete data. Untick it only if your integration needs to write. Click Save.
3. Copy the key
The API key created dialog shows the key once. It can't be recovered later, so copy it into a secure store before you click Understood. If you lose a key, delete it and create a new one. See Creating and Managing API Keys.
⚠️ Heads-up: An API key acts with Super User access to your organization: it can read all of your organization's data, whoever created it, and a full-access key can also change data. Never put a key in client-side code or share it in email or chat, and delete it straight away if it is exposed. See Understanding API access scopes and limitations.
Authenticate your requests
Send the key in the X-Api-Key header of every request. When a request has a JSON body (POST or PUT), also send Content-Type: application/json.
Request type | Headers |
GET, DELETE |
|
POST, PUT with JSON |
|
Send your first request
This example lists timesheet entries:
curl "https://app.mobaro.com/api/customers/timesheets" \
--header "X-Api-Key: YOUR_API_KEY"
The response is a JSON page of results with items, amount, offset and total.
This example creates a timesheet entry. It needs a key without Read-only:
curl "https://app.mobaro.com/api/customers/timesheets" \
--request POST \
--header "Content-Type: application/json" \
--header "X-Api-Key: YOUR_API_KEY" \
--data '{
"description": "Training session",
"user": "users/123456-A",
"type": "TIMESHEET_TYPE_ID",
"started": "2026-01-27T10:00:00Z",
"stopped": "2026-01-27T12:00:00Z"
}'
References such as user and type take Mobaro IDs, including the prefix. Look them up with the matching GET endpoint, for example /api/customers/users or /api/customers/timesheets/types. See Understanding IDs in Mobaro.
Filter and page results
List endpoints return one page at a time. Use Limit (1–128, default 128; Results 1–20, default 20) and Offset to page through them. Date filters take ISO 8601 date-times and differ by endpoint: Results, for example, use AnsweredAfter, ReceivedAfter or UpdatedAfter, while many other endpoints use CreatedAfter. Sort with OrderBy, using a field name, or the name with a - prefix for descending order.
For every endpoint's filters, see Mobaro API parameter reference or the interactive Mobaro API documentation, also linked from the book icon (tooltip Open Documentation) on the API Keys panel.
Limits and common errors
Each key can make up to 10 requests per second, and some write endpoints, such as those that change Users or Location Groups, have lower limits. Requests above a limit get 429 Too Many Requests, so wait and retry. Common responses:
Response | Meaning |
401 Unauthorized | The |
403 Forbidden | A read-only key tried to create, update or delete data. |
429 Too Many Requests | You exceeded the rate limit. Slow down and retry. |
503 Service Unavailable | The API is temporarily unavailable. Retry later. |
Best practices
Use a Read-only key unless your integration must write data, and give each integration its own key so you can delete one without affecting the others.
Store keys in a secrets manager, and call the API from a server, never from a browser or mobile app.
Test requests with Postman or curl before automating them.
Export large data sets in batches using date filters and paging, and retry with a delay after a 429.
Frequently asked questions
Where do I find my API key?
In Configuration › API › API Keys. You need Organization › Administrate to create one. A key is shown only once when it's created; if nobody saved it, delete it and create a new key.
I can't see the API tab in Configuration. How do I get access?
API access is enabled per organization by Mobaro. Ask your CSM to enable it. You also need Organization › Administrate to open Configuration.
Can I limit an API key to certain endpoints or data?
No. The only restriction is Read-only, which blocks creating, updating and deleting. Every key can read all of your organization's data.
Is there an API call to close an assignment or add a comment?
To change an Assignment's state, send PUT /api/customers/assignments/{id} with a stateChange, which can include a justification description. There is no endpoint for Assignment comments. Only endpoints under /api/customers are supported.
I get a CORS error when I call the API from my web page. Why?
The API doesn't accept calls from other websites' browser code. Call it from a server, script or integration tool instead, which also keeps your API key out of the browser.