The Firehouse Solutions Application Programming Interface (API) gives your developers read-only access to your website data as JSON over HTTPS. Nothing can be created, changed, or deleted through the API. Use it to feed station display boards, mobile apps, reporting tools, or any in-house software with live data from your website: news stories with photos, calendar events, training records, member rosters, custom databases, and more.

The API is available to every Firehouse Solutions website. A website manager creates an API Project in the Members Area under Manage > API. Each project receives its own refresh token and its own settings: status, allowed endpoints, and optional IP address lockdown. Create one project per application so each can be monitored and revoked independently.

All calls go to your own website's address. Throughout these pages, replace the example domain with your department's domain.

https://www.YourDepartment.com/apps/api/

The base address returns a catalog of the available endpoints and requires no token. Not a customer yet? See our features overview or contact Sales@FirehouseSolutions.com.

Authentication uses two tokens:

1. Refresh Token - created with your API Project, valid for 1 year. Keep it secret; treat it like a password.
2. Access Token - obtained from the refresh endpoint, valid for 24 hours. Send it on every data request in the Authorization header: Authorization: Bearer {access_token}

{
    "status": 200,
    "endpoint": "refresh",
    "domain": "www.YourDepartment.com",
    "project": "Your Project Name",
    "token_type": "Bearer",
    "access_token": "d99ce419-53b8-40f2-a747-...",
    "expires_in": 86400,
    "access_token_expire": "2026-09-06 14:00:00"
}

HTTPS only - requests over plain HTTP receive 403; tokens never travel in cleartext.
Read-only by design - data endpoints reject anything but GET.
Token regeneration - regenerate a project's refresh token at any time; all active access tokens are revoked immediately.
Failed-authentication lockout - 10 failed token requests from one IP within 10 minutes blocks that IP for 60 minutes.
IP Address Lockdown - optionally list allowed IP addresses on your API Project; all other addresses receive 403.
Endpoint Access - limit a project to specific endpoints.
Project Status - disable a project at any time.
Throttling - each project is limited to 30 calls per minute and 5000 calls per day. Exceeding a limit returns 429 with a Retry-After header. Check your consumption anytime with the usage endpoint or on your API Project statistics page.
Call Logging - every call (including failures) is logged for 90 days and shown on your API Project statistics page.
Passwords - passwords and account credentials are never available through the API.

Every successful data response uses this JSON structure. Some endpoints add extra properties (noted per endpoint), and items holds the records:

{
    "status": 200,
    "endpoint": "announce",
    "domain": "www.YourDepartment.com",
    "generated": "2026-09-05 14:00:00",
    "startRow": 1,
    "maxRows": 100,
    "count": 2,
    "totalCount": 57,
    "items": [ { ... }, { ... } ]
}

count is the number of records in this response; totalCount is all matching records regardless of paging. Page with StartRow and MaxRows until count + startRow exceeds totalCount.

Every API call answers with a standard HTTP status code and a JSON body, on success and on failure alike. Program against the codes below rather than the message text.

Every failure code returns this JSON structure. Branch on the machine-readable code value, not the message text:

{
    "status": 401,
    "error": "Unauthorized",
    "code": "token_expired",
    "message": "Access token expired. Request a new one from /apps/api/refresh using your refresh token."
}

All data endpoints are HTTP GET and require the Authorization: Bearer {access_token} header. All accept the common StartRow and MaxRows parameters. Click an endpoint for its parameters, response properties, and sample code.

Questions about the API? Contact us at Support@FirehouseSolutions.com.