API release notes

What's new in the SecurityTrax API

New endpoints, changes, and fixes for developers building on the SecurityTrax API, newest first.

Looking for platform updates instead? See the SecurityTrax release notes.

Never miss an API change

Get an email when new API release notes are published, or follow the RSS feed.

API v4 Release Notes — August 5, 2026

New

  • Alarm.com provisioning — provision Alarm.com service directly from the API with new actions on customers: discover your dealer's packages (adc_packages, with camera-only filtering), create the Alarm.com customer or commitment, activate a commitment, and change service plans. Customer app credentials are returned once in the create response. Duplicate provisioning is blocked so a customer can't end up with two Alarm.com accounts.
  • Guardian Protection Services provisioning — new guardian_options, guardian_save_account, and guardian_resync actions on customers for creating and syncing Guardian monitoring accounts.
  • ADT order lifecycle — eight new actions on customers cover the full ADT ordering flow: precheck a customer, fetch options and order data, save and submit an order, check order status, and cancel an order.
  • Integration reference pages — the API docs now include a dedicated reference page per integration (Alarm.com, Guardian, ADT) documenting each action's request and response.
  • Credit checks — run a live credit pull via the new run action on customer_credit_checks (all bureau types, with the same per-bureau options as the app), or record a manually obtained score via record. Reads support customer, bureau, and date filters, and credit checks are available as an include on customers. A same-customer, same-bureau pull within 24 hours is rejected as a duplicate unless you explicitly override with force: true.
  • Credit bureau catalog — new read-only credit_bureaus resource so you can discover the tenant's configured bureaus before running a check.
  • File uploads — attach files to customers and leads via the new object_files resource: POST the file bytes base64-encoded to upload (up to 20 MB), GET to read file metadata. Renaming, deleting, and downloading remain on v1 for now.
  • Inline invoice line itemsPOST /customer_invoices now accepts line items embedded in the create request, so an invoice and its lines can be created in one call. The write is all-or-nothing: if any line fails, nothing is saved.

Improved

  • Single-call customer importsPOST /customers now accepts monitoring account numbers (account_num, secondary_account_num, ADT identifiers), install fields (is_installed, install appointment, service flags), confirmation number, receiver number, abort code, and beacon score. Previously these were update-only, forcing a create-then-update round trip when importing already-installed customers.
  • Company-wide user readsGET /users and user_rep_numbers reads now return all users in the company (matching the app and earlier API versions) instead of only users sharing a location with the caller.
  • Company-wide user management — user edits, rep-number changes, and user deletion now follow the same company-wide permissions as the app. Deletion requires the User delete permission.

Fixed

  • Monitoring account numbers rejected on writeaccount_num, secondary_account_num, and the ADT identifier fields on customers could not be created or updated by regular API users even with full customer permissions. They now accept writes with the standard customer create/modify permission.

API v4 Initial Release Notes

We're excited to introduce API v4, a new generation of the SecurityTrax API. v4 is a modern JSON REST API served at /{profile}/user/v4/, with bearer-token authentication and permission-aware responses — the fields you can read and write always reflect your API user's permissions, the same rules enforced in the SecurityTrax app.

Full reference documentation is now published in the API docs book.

Customers & Leads

  • Customers — full create, read, update, and delete on customers and leads, including list filtering, sorting (?sort=), offset pagination (page / per_page), related-record includes (notes, equipment, invoices), and count_only for fast counts.
  • Notes, tickets & work orders — create and manage customer notes via customer_notes, with filters by customer, type, and record type, plus ticket and work-order includes.
  • Contacts — full CRUD on customer_contacts, matching the fields available in the app.
  • Tags — attach and detach customer tags via object_tags; tag name, color, and description are returned inline on reads.
  • Custom fields — set and clear customer custom-field (UDF) values via object_udfs.

Scheduling

  • Appointments — list, schedule, reschedule, and cancel technician appointments, and create and manage sales appointments, via calendar_events.
  • Confirmations — record and manage appointment confirmations via calendar_event_confirmations, with supporting catalogs for confirmation statuses and types.
  • Event detail types — full CRUD on calendar_event_detail_types, plus a read-only calendar_event_types catalog.

Equipment

  • Customer equipment — full CRUD and list on customer_equipment (cost and external-connection fields are read-only).
  • Work-order equipment — set and clear the equipment items attached to a work order via work_order_to_equipment.

Billing

  • Billing profiles — full CRUD on customer_billing, including payment methods. Card and bank numbers are always masked on read.
  • Invoices — full CRUD and list on customer_invoices and invoice_line_items, and one-call recurring-invoice setup via invoice_recurring (header and line items in a single request).
  • Payments — full CRUD on customer_payments, plus dedicated process, void, and refund actions.

Payables

  • Payables — manage customer_payables, their line items, and payments against them, plus a generate action to generate payables on demand.

Funding

  • Fundings — full CRUD on fundings and funding_transactions.

Administration

  • Users — create and manage users, including a reset_password action, rep numbers via user_rep_numbers, and permission assignment via user_to_group_location.
  • Groups & locations — full CRUD on groups and locations, with the sans as the app.

Catalogs

Read-only lookup resources for the IDs you reference elsewhere: account classrs, Sources and Source Campaigns, lead dispositions, lead types, MMR rates, monitoring companies, monitoring plans, terms, and warranties.