GrowLeafy ONE IDENTITY. PROTECT EVERYTHING.
Cart

Quickstart

Sign in, create an organization, generate scoped credentials, and create identities. First call in under 10 minutes.

POST /api/v1/partner-api/token { "client_id": "pk_…", "client_secret": "…" } → { "token": "…", "token_type": "Bearer" } POST /api/v1/organizations/{org}/assets/bulk { "count": 2000, "asset_type": "battery", "batch_id": "BAT-2026-09", "manufacturer": "ABC" }

Authentication

Machine access uses client credentials → scoped Bearer tokens. The organization comes from the credential, never from the request body. Secrets are shown once and stored hashed.

Sandbox / Production

Sandbox organizations keep experiments away from production — same API, same tooling. Every production action is clearly labelled and audited.

Identity

A GrowLeafy identity is persistent: physical identifiers can be replaced, the identity never changes. Resolution accepts QR tokens, NFC/serial/external references and converges to one identity.

POST /organizations/{org}/identifiers/resolve { "token": "GLQR-ABC123" } → { "status": "MATCHED", "asset_uuid": "…", "purpose": "public_identity" }

Assets & Identifiers

Many identifiers → one asset. Attach QR/NFC/serial/ERP identifiers to an existing asset; duplicate tokens return EXISTING_ASSET_FOUND — never a silent second record.

POST /organizations/{org}/assets/{u}/identifiers { "type": "nfc", "token": "04:AB:..", "purpose": "service" }

QR / NFC

The QR is the door, not the identity. One asset can hold many active identifiers with different purposes — public_identity, service, emergency, warehouse, warranty, document_access.

Organizations

One person → one identity → many organizations → many roles → many credentials. Enterprise membership never creates a second user.

Access Control & Grants

Organizations see only consented data domains through expiring access grants. No grant, no window. Each grant carries purpose, fields, consent state and expiry — and is audited.

Asset Graph

Systems, components, installations and organizations are edges over the same identity. Query the live graph to traverse: site → system → panel → owner → service.

Service & Warranty

Users request asset-contextual service; authorized providers update cases with an append-only timeline. Warranties and recalls attach to the same identity — recall matching uses batch/manufacturer/model.

Webhooks & Events

Signed, replay-protected deliveries: sha256=HMAC(timestamp + "." + raw_body, secret). Topic + asset-filtered subscriptions, retry with backoff, transactional outbox, delivery ledger.

Scopes

identity:read · identity:writeassets:read · assets:write relationship:createwarranty:create service:writewebhooks:write usage:read · billing:read

Errors & Limits

Every error: { error: { code, message, request_id } }. Key codes: VALIDATION_ERROR · UNAUTHENTICATED · FORBIDDEN · RATE_LIMITED · EXISTING_ASSET_FOUND · ASSET_NOT_CLAIMED. Bulk = 2,000/call; writes are idempotent by Idempotency-Key.

Security

Tenant isolation at the middleware, service and query layers. Credentials are machine identities, never human logins. No secrets in logs, never shown after creation, environment-separated, scoped, revocable.

Changelog

  • 2026-09 — Universal Asset Model (identifiers per asset, bulk 2,000/call), asset graph APIs, org windows + grants, passport + DPP + warranty/recall, outbox + asset-filtered webhooks, metering + versioned pricing, SCIM, enterprise↔user connectivity, territory engine + rule engine, auth intelligence (request_id → correlation_id → session_id → event_id).
  • Current — all endpoints listed above are live; nothing in this page is a mock.

SDKs & Integrations

The API is plain HTTPS + JSON — generate your own client from the OpenAPI specification with any generator you prefer. As of today there are no separately packaged GrowLeafy SDKs; we will not list libraries that do not exist.

# Python (requests) — create one identity import requests, os r = requests.post( "https://growleafy.in/api/v1/organizations/{org}/assets/bulk", headers={"Authorization": "Bearer " + os.environ["GROWLEAFY_TOKEN"]}, json={"count": 2000, "asset_type": "battery", "batch_id": "BAT-2026-09"}) print(r.json()) # { ids: [...], external_references: [...] }

Live integrations already inside the platform: Razorpay payments · MSG91 email/SMS · Shiprocket fulfilment · Google sign-in · SCIM 2.0 directory provisioning (organizations) · signed webhooks for ERP/CRM/service systems. External systems connect over the same scoped API — never a shared database.