Developers

An API for every layer of your network.

Connect ERP, BI, support, payment, roaming, and fleet tooling to Sparqly through a REST API and signed events — without reverse-engineering charger data.

REST API per domainHMAC signed webhooksOpenAPI contract

POST /api/v1/command-traces

{
  "charger_identity": "MAD-CHG-001",
  "command": "Reset",
  "mode": "soft"
}

The API surface

Four ways to integrate with the platform.

Read state, drive actions, and react to events — each on a contract built for production use.

REST API

A resourceful REST API across platform domains — sessions, tariffs, work orders, settlement, assets, partners, and tenants. Tokens are scoped, allowlist-aware, expiring, and rotatable.

Signed webhooks

Domain events are delivered over HTTPS only, signed with HMAC-SHA256, retried with exponential backoff, and recorded attempt by attempt.

OCPI roaming

OCPI 2.2.1 and OICP 2.3 CPO surfaces connect external roaming partners through explicit protocol contracts, validation, retries, and exchange evidence.

Gateway events

The OCPP gateway emits signed HTTP events the platform consumes. Integrate operational data without touching charger transport directly.

Authentication & events

Scoped tokens in, signed events out.

Every request is authenticated with a scoped token; every event you receive is signed so you can trust it. Two examples — the rest of the surface follows the same shape.

Authenticate a requestBearer token, scoped permissions, IP allowlists, expiry, and governed rotation.

curl https://api.sparqly.eu/api/v1/charging-sessions?status=active \
  -H "Authorization: Bearer spqpat_xxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Accept: application/json"

# Personal access tokens are hashed at rest and carry only
# the scopes granted to the integration — for example,
# sessions:read and work_orders:write.

Receive a webhookDomain events named domain.event_name, HTTPS only, HMAC-SHA256 signed.

POST https://your-endpoint.example.com  HTTP/1.1
Content-Type: application/json
X-Sparqly-Signature: sha256=9f86d081884c7d659a2feaa0c55ad015...

{
  "event": "charging_session.started",
  "tenant": "ten_8KQ",
  "occurred_at": "2026-05-21T14:02:18Z",
  "data": {
    "session_id": "ses_4VK",
    "evse": "MAD-201",
    "tariff_id": "tar_standard_es"
  }
}

# Verify X-Sparqly-Signature with your endpoint's signing
# secret before trusting the payload. Failed deliveries
# retry on a [60, 300, 900, 3600]s backoff schedule.

Built on contracts

Integrate against a contract, not a guess.

Every public surface is described by an OpenAPI contract. Writes are idempotent and errors return a consistent envelope, so an integration behaves the same in a retry as on the first call.

External roaming uses OCPI 2.2.1 and OICP 2.3 contracts for authorization, locations, EVSE status, tariffs, sessions, and charge detail records. Internal network roaming is a separate governed channel with bilateral agreements and linked home and visited records. The OCPP gateway remains isolated and emits signed HTTP events, so integrations never need charger-transport or database access.

Protocol exchange logs keep full request and response payloads as evidence, and API-driven mutations chain into the same audit trail as everything else — so an integration is auditable, not a blind spot.

Developer access

Planning an integration?

Tell us what you are connecting and we will walk through the API surface, scopes, and webhooks for your use case.

Talk to the team