Introduction

The OwlMar Public API (/v1/*) gives Enterprise customers programmatic, bearer-key authenticated access to their fleet's vessels, equipment, maintenance history, inventory, expenses, documents, crew certifications, charter bookings, trip logs, and ISM compliance records. If your team already runs an ERP, a BI dashboard, or a Slack workflow, this is how you connect it to OwlMar without anyone touching a browser.

What you can build

  • Sync maintenance history into an ERP nightly, so your finance system and your fleet ops platform never drift apart.
  • Post a Slack alert the moment a new expense lands on a vessel, instead of waiting for someone to check the app.
  • Pull a vessel's document library into a DMS your compliance team already trusts.
  • Reconcile expenses across an entire fleet in one script, instead of exporting CSVs from ten separate vessel views.

See the Recipes section for full runnable versions of all four.

Auth in one line

Every request carries a bearer key created from Settings → API Keys in the app:

curl
curl -sS "https://api.owlmar.com/v1/vessels" \
-H "Authorization: Bearer $OWLMAR_API_KEY"

Keys are scoped per-key to a set of vessels and a set of module grants — a key can never see more than its creator's own account could see in the app, even if it's misconfigured. Full details: Authentication.

The envelope, in one example

Every successful response is wrapped the same way, whether it returns one record or a list:

json
{ "data": [ { "id": "…", "vesselName": "Sea Wolf", "make": "Sunseeker", "model": "Predator 68" } ] }

Every error response looks the same too — switch on code, not on the human-readable message:

json
{ "error": "Invalid or revoked API key", "code": "AUTH_REQUIRED" }

Full contract: Response Envelope.

Note

This API is REST, JSON over HTTPS, and versioned at the URL (/v1/*). There's no GraphQL, no SDK to install — every example on this site is copy-pasteable curl, Node, or Python.

Where to go next

  1. Quickstart — get a key and make your first authenticated call in under 15 minutes.
  2. Authentication — how keys, scopes, and revocation work.
  3. Response Envelope — the shape every response follows.
  4. Recipes — four full integration patterns, ready to adapt.
Danger

Never expose your API key in client-side JavaScript, a mobile app bundle, or a public repository. Treat it like a database password — server-side only.