Skip to main content
Technical Preview

​
Overview

A client-mode connector for the Smartsheet API 2.0 that puts plant data into the sheets operations teams already work in. A typical flow appends a row to a shift log, downtime tracker or quality-check sheet whenever the broker sees an event, updates status and readings on that row as things change, keeps sheet-summary KPIs such as OEE, scrap or uptime current, adds a comment and a dashboard link to the row, asks the shift lead to confirm the cause with an update request, and moves closed rows to an archive sheet. The same connector reads sheets, rows, cell history, reports and dashboards back into the broker, and registers Smartsheet webhooks that post sheet changes to a Coreflux server connector. One connector carries 44 events (27 GET, 12 POST, 5 PUT; 17 writes, no DELETE). Topics use devops/smartsheet/<object>/<verb>; each response is published on <source topic>/response.
The template was checked against Smartsheet’s OpenAPI reference and a local mock. ServerInfo was called live, without a token, on the US, EU and AU hosts. Every event was sent to api.smartsheet.com with a dummy token, and each one answered 401 with error code 1002 (invalid token). Without a token, 18 events also showed that Smartsheet connectors their path and method: the real path was refused (401 or 403) while the same path with a bad suffix answered 404. Nothing has run with a real token yet, so status stays blocked until an authenticated read and a row write pass.

​
Setup

  1. In Smartsheet, open Account > Apps & Integrations > API Access and generate an API access token. The token acts as the user who created it, so use a service account (for example plant-integration@example.com) that is shared on the sheets you automate. OAuth 2.0 access tokens work the same way.
  2. Keep the token in a broker secret (for example SMARTSHEET_ACCESS_TOKEN) and inject it in a LoT action with GET SECRET. Never retain topics that carry it.
  3. Read the sheet once with SheetGet or ColumnsList to get its column ids. Rows are written by column id, not by column title.

​
Authentication

Every event sends Authorization: Bearer <token> built from the access_token field of the payload:
ServerInfo also works with an empty access_token, which makes it a simple reachability check.

​
Regions

The template points at https://api.smartsheet.com (paths under /2.0/). For Smartsheet Regions Europe change BASE_ADDRESS to https://api.smartsheet.eu; for Smartsheet Regions Australia use https://api.smartsheet.au. Each region issues its own tokens, so a token from one region does not work on another.

​
Query parameters and bodies

Events that take query parameters read them, already URL-encoded, from query (for example rowsModifiedSince=2026-10-05T06%3A00%3A00Z&level=2). Leave query empty for defaults. Writes send JSON from body. Smartsheet ids are 64-bit integers: send them as JSON numbers inside body, and as plain digits in path fields such as sheet and row. Values are sent as given, so URL-encode query yourself.

​
Examples

Append a downtime row when a press stops (devops/smartsheet/rows/add):
Smartsheet answers with result, which holds the new rows and their id values. Keep the row id to update the row later. Close the row when the press restarts (devops/smartsheet/rows/update):
Read only the rows that changed this shift (devops/smartsheet/sheets/get):
Poll devops/smartsheet/sheets/version/get first if you only need to know whether anything changed. Update a KPI in the sheet summary (devops/smartsheet/sheets/summary/fields/update):
Send sheet changes to a Coreflux server connector (devops/smartsheet/webhooks/create, then devops/smartsheet/webhooks/update with {"enabled": true}):
New webhooks are created disabled. When you enable one, Smartsheet sends a verification request to callbackUrl with a Smartsheet-Hook-Challenge header and a challenge body field. The receiving server connector must answer 200 and echo the value in a Smartsheet-Hook-Response header or a smartsheetHookResponse JSON field. Smartsheet repeats this check once every 100 callbacks and disables the webhook (DISABLED_VERIFICATION_FAILED) if it fails. Requests come from webhooks.smartsheet.com. Callbacks carry only event metadata (object type, ids, event type), so read the changed rows with RowGet or SheetGet.
Every write event sends Smartsheet-Change-Agent: coreflux-broker. Callbacks for changes made through this connector then carry changeAgent coreflux-broker, so the server connector can skip them and avoid update loops.

​
Events

​
Limits

Smartsheet allows 300 requests per minute per token for most operations. Cell history and file attachments count ten times, which leaves 30 requests per minute. Above that Smartsheet answers 429 with error code 4003. Batch rows into one RowsAdd or RowsUpdate call instead of one call per value. Lists are paginated: use page and pageSize (or includeAll=true) on most lists, and maxItems and lastKey on workspaces, folder children and dashboards.

​
Not packaged

  • All DELETE endpoints (sheets, rows, columns, discussions, comments, attachments, webhooks) on purpose. Archive closed rows with RowsMove instead.
  • File uploads (multipart or binary) to sheets, rows and comments. RowAttachmentAddUrl attaches links only.
  • Sharing, groups, user administration, favorites, proofs, automation rules, cross-sheet references, publish settings, sheet import, event reporting (enterprise audit) and OAuth token exchange.
  • The incoming webhook direction: Smartsheet posts callbacks to a separate ENABLE_SERVER REST_API connector, which must answer the verification challenge.

​
Suggested branches

feat/rest-api-route-smartsheet for the broker template and feat/docs-rest-api-smartsheet for this page.
Last modified on October 21, 2026