Tenant API v1 — Assets
Base path: /api/tenant/v1
Middleware: auth:tenant-api, tenant.user, verified, module:assets, plus permission middleware / policies.
Assignee scoping: without assets.assign (and not superadmin), list/stats/view/update only include assets where assigned_to is the current user.
Stats
GET /assets/stats
Same filters as list (minus pagination/sort). Payload includes:
total_assets, my_assets, unassigned, active, in_repair, retired, disposed, scope (org|mine).
Assets CRUD
GET /assets
Query: search (name, number, serial_number, manufacturer, model, location), status, category, assigned_to (unassigned or user id), my_assets, trashed, sort, direction, page, per_page.
List items include latest_note and nested assignee / creator / optional vendor / optional employee.
POST /assets
Body:
| Field | Rules |
|---|---|
name | required, string |
status | active | in_repair | retired | disposed (default active) |
category | equipment | furniture | vehicle | electronics | software_license | other |
manufacturer, model, serial_number, location | optional strings |
purchased_at, warranty_ends_at | optional dates |
purchase_cost | optional numeric |
useful_life_months | optional integer 1–1200 |
salvage_value | optional numeric |
depreciation_starts_on | optional date |
currency | optional, max 3 chars |
assigned_to | optional user id (EligibleAssetAssignee — same pool as leads; owners excluded for explicit assign; null clears) |
vendor_id | optional; requires Vendors entitled (LinkableVendor) |
employee_id | optional; requires Employees entitled (LinkableEmployee) |
number is server-generated (AST- + sequence; prefix from assets_number_prefix).
GET /assets/{id}
Includes assignee, creator, vendor, employee, notes, activities, accumulated_depreciation, book_value, capitalization journal when loaded, and depreciations. Embedded notes and timeline/domain activities are newest-first (created_at DESC, then id DESC).
PUT /assets/{id}
Partial update of asset fields (including soft FKs and assigned_to).
DELETE /assets/{id}
Soft delete. Permission: assets.delete.
POST /assets/{id}/restore
Restore a soft-deleted asset. Permission: assets.restore.
DELETE /assets/{id}/force
Permanently delete a soft-deleted asset. Permission: assets.force.delete.
Actions
POST /assets/{id}/assign
{ "assigned_to": number|null } — must be an eligible custodian (CRM lead pool) or null to unassign. Workspace owners cannot be selected for explicit assign.
POST /assets/{id}/depreciate
{ "period": "YYYY-MM" }. Permission: assets.depreciate. Requires Accounting. Capitalizes once, then posts that month. Duplicate month, retired/disposed, foreign currency, missing cost or life, and a fully depreciated asset return 422.
POST /assets/depreciate
Same body. Posts every eligible asset for the month. Response data is { period, posted, skipped, failed, results }.
POST /assets/{id}/notes
{ "body": string }
GET /assets/{id}/timeline
Asset activity timeline entries.