Distributors
Sync tray and loaner movement into your own systems so field teams and billing share the same location truth.
Integrations
Your asset data, in every system that needs it
Hansel tracks surgical trays, implant totes and loaner kits automatically. Our REST API, workspace-scoped OAuth, signed webhooks and MCP tools put that data into the systems you already run — without adding work for operations teams.
- Workspace-scoped OAuth
- HMAC-signed webhooks
- Read-only MCP tools
REST API
A single source of truth for asset location and custody
Every tray, tote, beacon, facility and movement event is available through a versioned REST API. Read what you need, when you need it, and keep your own systems in sync.
-
Assets and inventory
Read tray, tote and implant records with identifiers, status and manufacturer in one call.
-
Movement history
Pull an asset's movement history so your systems know where it has been.
-
Locations
List facilities and sites your workspace can see, including address and type.
-
Autoclave cycles
Read autoclave cycle history for a tray.
-
Hansel Tag Management
Assign or unassign Hansel tags against your assets.
-
On Site Status
Show what is currently on site and where.
curl https://api.hanselmedical.com/api/v1/assets \
-H "Authorization: Bearer $ACCESS_TOKEN"
{
"success": true,
"data": {
"assets": [{
"id": "a7249a84-c9de-48ca-a36b-4b14fa71b179",
"name": "Tray 12",
"serial_no": "SN-001",
"common_name": "Surgical Tray",
"device_type": "Surgical Tray",
"status": "Active",
"manufacturer": {
"id": "b7c2fb61-1ded-4917-b79a-9bfc89468208",
"name": "Acme Medical"
},
"active_beacon": {
"current_state": {
"location": {
"id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
"name": "Example Hospital",
"type": "Hospital"
}
}
}
}],
"pagination": {
"per_page": 25,
"current_page": 1,
"total_pages": 1,
"total_records": 1
}
}
}Page-based pagination and a consistent { success, data } envelope. Documentation is available from your Hansel workspace.
OAuth 2.0
Access your security team can sign off on
No shared API keys pasted into scripts. Hansel uses standard OAuth 2.0 so access is scoped to a workspace, expiring, and issued per client.
-
Register your client
Create an API client in the Hansel account (up to five per account) and bind it to a workspace.
-
Request a token
Exchange your client credentials for a workspace-scoped token. Tokens last one hour.
-
Call with least privilege
Send the token as a Bearer credential. OAuth clients can only reach the public REST surface.
-
Rotate and revoke
Rotate the client secret or delete the client when an integration is retired.
-
Workspace-scoped access
Every token is bound to exactly one workspace. It cannot see another workspace on the account.
-
Client credentials for services
Machine-to-machine tokens for internal services and partner systems.
-
Short-lived tokens
Access tokens expire after one hour. Request a new token when it expires.
-
Separate MCP consent
AI assistants use a different OAuth flow (authorization code + PKCE) and cannot call the REST API.
Webhooks
Act when an asset moves or a tray is cycled
Stop polling for changes. Hansel pushes signed, batched events to your HTTPS endpoint so downstream systems can react.
Example Events
-
Tracking Activity
Receive movement and location scans, including scan, entry and exit events.
-
Autoclave Cycles
Receive information about the latest cycle instance for trays on site.
Example use cases
-
Know the moment a tray arrives
When a tray or tote enters a hospital, your endpoint can update inventory or notify the field team.
-
Keep consignment in sync as assets leave
When an asset exits a site, write that movement into your own systems so billing and ops share the same location truth.
-
Record autoclave cycles as they happen
When a tray is cycled, capture the latest cycle in your quality or consignment record instead of polling for it.
- HMAC-signed payloads
- Retries with backoff
- Idempotency keys on every delivery
- Up to 100 events per batch
X-Webhook-Timestamp: 1716200000
X-Webhook-Signature: v1=abc123...
Idempotency-Key: 550e8400-e29b-41d4-a716-446655440000
{
"id": "550e8400-e29b-41d4-a716-446655440000",
"webhook_id": "7c9e6679-7425-40de-944b-e07fc1f90ae7",
"type": "tracking.batch.v1",
"account_id": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
"generated_at": "2026-05-20T14:30:00Z",
"idempotency_key": "550e8400-e29b-41d4-a716-446655440000",
"events": [{
"history_id": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
"occurred_at": "2026-05-20T14:28:00Z",
"event": "entered_location",
"asset": {
"id": "f47ac10b-58cc-4372-a567-0e02b2c3d479",
"name": "Tray 12",
"common_name": "Surgical Tray",
"serial_no": "SN-001",
"device_type": "Surgical Tray"
},
"beacon": { "identifier": "HM-1-42" },
"location": {
"id": "6ba7b810-9dad-11d1-80b4-00c04fd430c8",
"name": "Example Hospital"
}
}]
}MCP tools
Let approved AI assistants answer asset questions
Hansel exposes Model Context Protocol tools so the AI clients you already govern can query live asset data — under the same workspace scope as any other integration.
-
Natural-language asset lookups
Search by name, serial or custom reference against live Hansel data.
-
Same workspace boundary
MCP Connect tokens are scoped to one workspace and the mcp:use permission.
-
Drop into existing clients
Connect from Cursor, Claude or ChatGPT after the user signs in and picks a workspace.
-
Read-only by default
Public MCP tools look up assets, locations and cycles. They cannot write.
Example: someone asks where Tray 12 is. After thinking, the assistant says Tray 12 is at Example Hospital, last seen today at 14:28, and on site rather than in transit. They then ask what was cycled there this morning. The assistant says Tray 12 completed a cycle at Example Hospital this morning, and two other trays at that site were also cycled.
Who it is for
Built for the systems each team already runs
-
-
Manufacturers
Feed movement and autoclave-cycle data into planning and consignment reconciliation.
-
Facilities & ASCs
Surface on-site versus in-transit status in your own ops and scheduling workflows.
Enterprise readiness
Integration work that survives procurement
Security review, IT governance and go-live support are part of the process, not an afterthought.
- Workspace-scoped OAuth tokens
- Tokens are bound to one workspace. Clients cannot wander across the account.
- HMAC-signed webhooks
- Every delivery is signed with a timestamp and v1 HMAC so you can verify it came from Hansel.
- Named integration support
- A Hansel engineer on your implementation calls until data is flowing.
- Security by Design
- Data is encrypted at rest, and is served only over HTTPS in transit.
FAQ
Questions IT and security ask first
How long does a typical integration take?
Most teams start by creating a workspace-scoped OAuth client and reading assets and locations the same day. Webhook subscriptions usually follow once your HTTPS endpoint can verify signatures and return 2xx.
Is API, webhook, and MCP access included in pricing?
Hansel is priced per asset. API clients, webhook endpoints and MCP Connect are part of the platform — there is no per-seat license for the engineers who build on them. MCP Connect may depend on your workspace configuration.
How are API tokens scoped?
Each OAuth client-credentials token must request exactly one workspace:{uuid} scope. The token can only see data in that workspace.
Which webhook events are available today?
Two topics: Tracking Activity (tracking.batch.v1) for movement and location scans — including scan, entry and exit events — and Autoclave Cycles (autoclave_cycle.batch.v1) for the latest cycle instance for trays in that flush window.
What happens if our webhook endpoint is down?
Hansel retries with backoff for several hours. Each POST carries an Idempotency-Key so your handler can ignore duplicates. After repeated failures an endpoint can be disabled; you can send a test delivery from the account once you are ready.
What is the difference between the REST API and MCP Connect?
REST API clients use machine-to-machine tokens to read asset data into your own systems. MCP Connect uses a user sign-in (authorization code + PKCE) so an approved assistant can look up assets in the workspace they were granted. The two credentials are not interchangeable.
Can AI assistants change data in Hansel?
No. The public MCP tools are read-only lookups for assets, locations, in-transit status and autoclave cycles.
How do we get the API reference?
API documentation is available from your Hansel workspace. Request a demo and we will walk your team through the REST surface, OAuth setup, webhook topics and MCP Connect on the first call.
Talk through your integration
Tell us which systems need Hansel data and we will walk your team through the API, OAuth setup, webhook topics and MCP access on the first call.