Production data, without shared passwords.

Set up Postman

1. Open Dashboard -> Settings -> Customer API.
2. Create an integration and restrict it to only the required sites and lines.
3. Download the ZIP and import both the collection and environment JSON files into Postman.
4. Use Postman's environment selector in the upper-right corner to select IOTSnap Customer API. Selecting only the collection is not enough.
5. Open a request and inspect Variables. Values such as {{siteId}}, {{lineId}}, and {{pageSize}} must resolve from the imported environment. Remove conflicting global or collection variables instead of copying the JWT into them.
6. Send Discover reachable hierarchy and exportable tags first. Its test script fills the site, line, machine, tag, and machine-queue environment values.
7. Run individual examples with Send, or open Run collection to execute the full workflow.

Read every machine

Discovery stores every authorized machine in machineTargets. The Read every discovered machine request uses machineIndex to repeat itself in Collection Runner. Runner shows one response per machine and then continues to downtime requests. Clicking Send executes only the currently selected machine.

Change a query safely

Edit the imported environment when changing reusable values such as from, to, aggregationIntervalSeconds, or pageSize. Keep request URLs in {{variableName}} form so all requests continue to use the same environment. Run discovery again after scope or hierarchy changes.

Linux and Windows

Postman works the same way on Linux and Windows because the requests and imported environment are platform-independent. The authentication guides provide Bash commands for Linux and PowerShell commands for Windows when you move outside Postman.

Treat a generated package as a secret. Do not commit it, paste its JWT into tickets, or send it through chat. Request a replacement package when needed.

Passwordless authentication

Customer API credentials use signed JWT, OAuth bearer tokens, or registered mTLS certificates. They never use a Wavac username and password.

JWT or OAuth

# HTTP header example: replace the placeholder with the short-lived token.
Authorization: Bearer <access-token>

mTLS

Present the registered client certificate during the TLS handshake. Use the dedicated mTLS endpoint supplied by your operator; the standard web ingress does not accept client certificates. See the mTLS setup guide.

For complete examples, see OIDC OAuth 2.0, signed JWT, and the security overview.

CSV export

Export CSV from the Data tab when you need approved customer data without writing an API client. The export follows the same operator-managed data policy as the Customer API.

The browser workflow is identical on Linux and Windows. The finished CSV is saved to the download location configured in your browser.

1. Open Dashboard -> Data -> Counts & Tallies.
2. Select the site and line in the Dashboard scope selector, then choose the machines to include.
3. Choose a preset or custom time window and select Load. The selected window cannot be longer than the configured maximum time range.
4. Use Summary -> Export CSV for one counter-total row per approved Friendly Tag.
5. Use Data Explorer -> Export Raw CSV when raw data is allowed. When raw data is disabled, the tab and file show aggregates at the minimum permitted interval instead.
6. Use Downtime Events -> Export CSV for downtime rows when the downtime source is enabled.

What the policy controls

• Only Friendly Tags marked for export are loaded or written to CSV.
• The source must be enabled, and the requested window cannot exceed its maximum time range.
• Raw values are never loaded when raw access is disabled. Aggregate exports use at least the configured minimum interval.
• The result limit caps the rows returned in one loaded export. Narrow the time window or machine selection when the limit is reached.
• Customers can view the effective behavior but cannot change these controls; a platform operator manages the policy.

CSV files can contain production-sensitive information. Store them in an approved location and share them only with people authorized for that customer, site, and line.

Queries

Production requests use https://api.wavac.io. Site scope is required for data reads; line and machine filters narrow it further.

# Request one hour of approved data for one discovered site.
# Replace site-id with a value returned by discovery.
GET /api/customer/v1/data?siteId=<site-id>&from=2026-09-01T00:00:00Z&to=2026-09-01T01:00:00Z&pageSize=1000

Pagination

Set pageSize to the number of results requested. When a response contains nextCursor, send that opaque value unchanged as cursor on the next request. Do not decode or construct cursors.

# Request the next page using nextCursor exactly as the API returned it.
# Keep the original site and filters unchanged between pages.
GET /api/customer/v1/data?siteId=<site-id>&pageSize=1000&cursor=<nextCursor>

Every returned page consumes one data-page request from the integration's daily UTC allowance.

Rate and result limits

• Every returned page consumes one data-page request from the integration's daily UTC allowance.
• The server may lower the requested page size to the customer, source, or global maximum.
• Time-range, raw-data, filtering, and aggregation permissions are evaluated per approved data source.
• A site- or line-scoped credential cannot discover or query resources outside that scope.

Errors

When requesting help, include the UTC timestamp, endpoint, HTTP status, and correlation identifier. Never include the bearer token, client certificate private key, or generated package.