The Asset Management plugin's API

Under /api/v1/x/assets, 404 while the plugin is off; assets:read and assets:write. Guide: assets. An asset's <id> takes its id or its key (AST-12). Reading needs asset.read anywhere in the asset's organization, changing it asset.write.

Endpoint	What
GET ?orgId=&type=&status=&holder=&owner=&renewing=&returns=yes&serviceId=&ciId=&q=&page=&pageSize=	The register, newest first. type: one or more, comma-separated; status: current (not disposed, the default), all, or one or more statuses, comma-separated; holder: me, none or an id, seats included; owner: me or an id; renewing: renewing or out of warranty within that many days; returns=yes: held by, or with a seat for, people who were disabled; q: words in the name, tag, serial number or location, or a key. { items, total, page, pageSize }.
GET count?orgId=	{ current, inUse, inStock, renewing, returns, mine }.
GET costs?orgId=	Cost per service, a month: { currency, services: [{ id, code, name, monthlyCents, assets }], unlinkedMonthlyCents, other: [{ currency, monthlyCents }] }, in the currency used most (the others in other). Yearly costs count a twelfth; one-off costs are left out; an asset linked only to a configuration item is shared equally between the services above it.
GET held-by/<userId>	What a person holds or has a seat on (me for you). { items }.
GET <id>	The asset with its assignments, history, disposal and may: { write }.
POST /	{ orgId, name, type, status, tag, serial, supplierId, costCents, currency, costPeriod, purchasedOn, renewsOn, warrantyUntil, holderId, ownerId, location, ciId, serviceId, seats, notes }. type: hardware, licence, subscription, domain, other; status: ordered, in_stock, in_use, in_repair, retired; costPeriod: once, month, year; dates as 2026-12-31. seats only for a licence (400 otherwise). People, the supplier, service and configuration item must be of the organization (400 unknown_ref). The owner is you if left out. 201.
PATCH <id>	The same fields, except orgId; each change goes to the history. A disposed asset can't be changed (400).
DELETE <id>	Only an asset with nothing in its history but being added, no holder and no seats (400 in_use). Audited as assets.deleted.
POST <id>/seats	{ userIds }: gives each a seat. More than seats is allowed. 200, the asset.
DELETE <id>/seats/<userId>	Takes a seat back.
POST <id>/dispose	{ how }: the asset is disposed of, its seats freed. Final. 200, the asset.

Events: assets.created and assets.disposed. MCP tools: list_assets, get_asset, asset_costs, create_asset and update_asset.