Getting Started with the Senturo Reporting API

Overview

The Senturo Reporting API lets you pull your device fleet data directly into your own tools. Instead of exporting from the dashboard, you can query your devices, their location history, network connections, notes, and geofence activity over HTTPS, and feed the results into a spreadsheet, a business intelligence tool, an asset management system, or a scheduled script.

This article covers everything you need to make your first successful request: how to obtain a token, how to authenticate, and the four conventions that govern every endpoint — pagination, date filtering, rate limits, and error handling. Once you are comfortable with these, the Senturo Reporting API Endpoint Reference documents each endpoint in full.

The API is read-only. Every request uses GET, and no endpoint creates, modifies, or deletes anything in your Senturo account. It is a reporting surface, not a management interface, so device actions and configuration changes are still performed in the Senturo dashboard.

You do not need to be a developer to use it. Any tool that can make an HTTP request with a header — including Microsoft Excel's Power Query, Power BI, Google Sheets with a script, or a command-line tool such as curl — can retrieve data from the Reporting API.

---

What the Reporting API Covers

---

Requesting Your ReportToken

Access to the Reporting API is controlled by a ReportToken, which Senturo issues for your organization.

To request a token, contact support@senturo.com from an email address associated with your Senturo account. Include your organization name and let the team know you are requesting Reporting API access.

Your token identifies your organization and grants read access to your data, so treat it like a password:

• Store it in a secrets manager, an environment variable, or your reporting tool's credential store.
• Do not commit it to a code repository, paste it into a shared document, or include it in a screenshot.

If your token is exposed, contact support@senturo.com and request a replacement. Senturo will regenerate the token for your organization. The previous token stops working once it has been regenerated, so update any systems that use it.

---

Making Your First Request

All requests share the same base URL:

https://api.senturo.com/api/report/v1

Your token goes in the Authorization header, prefixed with ReportToken and a single space:

Authorization: ReportToken your_token_here

The following request returns the first device in your organization. Replace your_token_here with your own token:

curl -H "Authorization: ReportToken your_token_here" "https://api.senturo.com/api/report/v1/devices/?page_size=1"

A successful response looks like this:

json

{   "count": 248,   "next": "https://api.senturo.com/api/report/v1/devices/?page=2&page_size=1",   "previous": null,   "record_exists": true,   "results": [     {       "serial": "ABC1234XYZ",       "name": "LIBRARY-07",       "platform": "windows",       "device_status": "monitored",       "assignee_name": "Jane Doe",       "assignee_email": "jdoe@example.com",       "created_on": "2026-03-01T10:34:34.164748-04:00",       "last_seen": "2026-09-08T15:22:17.844800-04:00",       "postal_code": "05401-1234",       "geofence_status": [         { "name": "Main Campus", "inside": true }       ],       "last_location": 1053972397,       "location_link": "https://www.google.com/maps/search/?api=1&query=44.47,-73.21",       "os_version": "10.0.19045.0"     }   ] }

The count field tells you how many devices are in your organization in total. The results array holds the records for this page.

The trailing slash is required. /devices/ works; /devices returns a 404 and is not redirected. Every path in this API ends with a slash, including paths that end in an identifier.

Prefer to explore interactively? The live API specification at https://api.senturo.com/api/report/swagger/ lists every endpoint and includes a Try it out panel. Click on Authorize, enter ReportToken your_token_here, and you can run requests directly from your browser.

---

Authentication

Every request requires the Authorization header. If authentication fails, the API returns a 401 with a message describing what went wrong:

Check your prefix first. Sending the token with the wrong prefix, or with no prefix at all, produces the same message as sending no credentials whatsoever. If you are certain your token is correct but still receive "Authentication credentials were not provided", the prefix is the most likely cause.

---

Working With Dates

Every date parameter accepts ISO 8601 values. Always include the UTC offset for your account's timezone:

2026-09-01T00:00:00-04:00

Values without an offset are accepted, and so is a date on its own such as 2026-09-01, but a value without an offset may be interpreted in a different timezone than you intend. This shifts your results by several hours without any error being returned. Including the offset removes the ambiguity.

Default Date Ranges

Two endpoints apply a default date range when you do not supply one:

Endpoint	Default range when no dates are supplied
Location history	The most recent 30 days
Geofence evaluation	The most recent 7 days

This is the most important behaviour to understand before you build anything. A request without dates returns a 200 and a count that looks perfectly reasonable, with no indication that older records exist. A device that has not reported a location in the last 30 days returns zero location records, even when months of history are available. Supplying any date filter removes the default and gives you access to the device's full history.

On the geofence endpoint, timestamp_start and timestamp_end are honoured only as a pair. Supplying one without the other has no effect and the 7-day default applies instead.

---

Pagination

Endpoints that return lists wrap their results in a consistent structure:

Control paging with page and page_size:

• page_size defaults to 20 and is capped at 100. Requesting more returns 100 records.
• An invalid page_size such as 0 or a non-numeric value falls back to 20 rather than returning an error.
• Requesting a page past the end of the results returns a 404 with the message Invalid page.

The reliable way to retrieve a complete set is to request the first page and follow next until it returns null. Each next value is a complete URL you can request as-is.

python

import urllib.request, json  url = "https://api.senturo.com/api/report/v1/devices/?page_size=100" headers = {"Authorization": "ReportToken your_token_here"} devices = []  while url:     request = urllib.request.Request(url, headers=headers)     with urllib.request.urlopen(request, timeout=60) as response:         page = json.load(response)     devices.extend(page["results"])     url = page["next"]  print(f"Retrieved {len(devices)} devices")

A fleet of 1,000 devices takes ten requests using this approach, comfortably within the rate limit.

---

Rate Limits

The API allows 120 requests per minute per token, measured on a rolling window and applied across all endpoints combined. Requests beyond that limit return a 429:

json

{"detail":"Request was throttled. Expected available in 60 seconds."}

A 429 response includes a Retry-After header giving the number of seconds to wait. Pause for that period and retry rather than continuing to send requests, since further requests during the window are also rejected.

For scheduled reports, spacing requests slightly keeps you well clear of the limit. Retrieving a 1,000-device fleet along with location history for each device is a few hundred requests, which is comfortable if spread over a few minutes.

---

Response Codes

Unrecognised parameters are ignored, not rejected. A misspelled filter name returns a 200 with unfiltered results rather than an error, which can look like a filter that is not working. Check spelling against the endpoint reference if a filter appears to have no effect.

---

Troubleshooting

"Authentication credentials were not provided" but the token is correct: The Authorization header must read ReportToken followed by a space and then the token. A missing prefix, or a different prefix such as Bearer, produces this message. If the prefix is right and the message is Invalid token. instead, the token itself is not being recognised — contact support at support@senturo.com to confirm it is still active.

A device returns no location history, but Senturo shows location data for it: Location history returns only the most recent 30 days unless you supply a date filter. Add received_after with the date you want to start from, and the device's full history becomes available.

A request returns a 404 that should succeed: Confirm the path ends with a trailing slash. Paths without one return a 404 and are not redirected.

A filter appears to have no effect: Unrecognised query parameters are ignored rather than rejected, so a misspelled parameter name returns unfiltered results with a 200. Check the spelling against the endpoint reference.

A geofence request covers a shorter period than requested: Check that both timestamp_start and timestamp_end are present. If only one is supplied it is ignored and the default 7-day window applies.

The first request to an endpoint times out: The first location history request for a device with extensive history can take up to a minute while the total record count is calculated. Later requests are fast. Set your client timeout to at least 60 seconds.

Results are shifted by several hours: Date values without a UTC offset may be interpreted in a different timezone than intended. Add the offset for your account's timezone to every date parameter.

---

Conclusion

With a ReportToken and the conventions above, you can retrieve any of your fleet data programmatically and keep your own reporting up to date without manual exports. The two behaviours worth committing to memory are the trailing slash on every path and the default date ranges on location history and geofence evaluation — between them they account for most unexpected results.

For the full detail of every endpoint and field, see the Senturo Reporting API Endpoint Reference. For ready-made reports covering device audits, recovery workflows, and geofence activity, see Senturo Reporting API: Example Reports and Use Cases. To request a token, have one regenerated, or ask about behaviour not covered here, contact support at support@senturo.com.

---

FAQs

Q: Can I use the API to lock a device, change its status, or send a broadcast? A: No. The Reporting API is read-only and every endpoint uses GET. Device actions and configuration changes are performed in the Senturo dashboard.

Q: Do I need a developer to use this? A: Not necessarily. Any tool that can make an HTTP request with a header can retrieve data, including Power BI, Excel's Power Query, and Google Sheets with a script. The examples in these articles use curl and Python because they are the clearest to read, but the requests themselves are simple.

Q: How many tokens can my organization have? A: Tokens are issued per organization. If you need access for more than one system, use the same token in each rather than requesting several, and store it separately in each system's credential store.

Q: Does the API count against any dashboard limits, or affect my devices? A: No. Requests only read data that Senturo has already collected. Nothing is sent to your devices, and device behaviour is unaffected.

Q: Why does a device show a recent check-in but return no location records? A: Checking in and reporting location are separate. A device can be connected and reporting its status while location services are unavailable on it. Also confirm you are supplying a date filter, since location history returns only the most recent 30 days by default.

Q: Which timezone should I use in date filters? A: Always include an explicit UTC offset, such as 2026-09-01T00:00:00-04:00. Values without an offset are accepted but may be interpreted differently than you expect, silently shifting your results.