Public API & ERP/IoT Ingest

Manual entry does not scale to an organization whose activity data already lives in an ERP or flows from meters. The Public API exposes CarbonBiz to those systems in a vendor-neutral way. Authentication uses API tokens hashed with bcrypt and shown in full only once at creation, or the OAuth 2.0 client credentials flow for machine-to-machine access. Webhooks let external systems subscribe to events, with each delivery signed with HMAC SHA-256 and the signing secret stored encrypted.

Two ingest tracks are available. The activity ingest endpoint accepts single activities or batches of up to 500 from an ERP; rows are processed partially by default, so duplicates are skipped and broken rows are reported as failed while the rest succeed, and CO2e is calculated with the same library the web forms use. The meter-reading endpoint accepts time series from IoT gateways or edge meters and rolls them up into Scope 2 activities automatically, giving near-real-time electricity data.

Both tracks are idempotent: activities are de-duplicated on an external reference and readings on meter ID plus timestamp, so retries never create duplicate records. The organization is always derived from the token, never from the payload. An integrations screen manages tokens, registers meters and shows the ingest log, and the API documentation is generated automatically as OpenAPI 3.1 with request and response examples.