Agentic Fabriq
HotspotSystem
BUSINESS · COMMERCE & FINANCE
Hotspot locations, customers, subscribers, vouchers, and login transactions in the account they connected.
Connecting HotspotSystem in practice
HotspotSystem’s v2.0 API documents HTTP Basic authentication with the API key as the username and an empty password, while its own cURL and PHP examples send that key in an sn-apikey header instead, so both forms are worth testing before shipping. Pagination is only discoverable from RFC 5988 Link headers, which the docs tell you to follow rather than building URLs yourself.
Scopes that draw scrutiny
Control Center API keyGenerated under Control Center → Tools & Settings → API Keys. The documentation describes a single key type, so the same credential reads customers, vouchers and every location on the operator account.
Worth knowing
- API v1.0 is explicitly deprecated and has its own separate documentation site, so an older integration is on a frozen surface rather than a supported one.
- Every request must be over SSL and every string UTF-8; dates are strings in the form "2013-05-21 17:53:39" with no timezone, so interpretation is left to the caller.
- Follow the Link header’s rel="next" instead of constructing limit and offset yourself — the documented contract is the header, not the query string.
- The API surface is metadata about customers and vouchers, so a key that looks read-only in intent is still a full customer-list export.
Checked against API v2.0 notes (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put HotspotSystem behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.