What's New

You can now automate Spotflow from your own scripts and CI/CD pipelines. Everything you do in the Spotflow web application is also available through the Management API.

Until now, getting a new firmware version onto your devices meant manual steps in the portal: create the version, upload the image, attach the ELF file so crash reports decode, start the rollout. Skip one, and the first crash from the new version shows up undecoded. Now your pipeline does every step on every release, the same way each time. The guide includes a ready-to-use GitHub Actions workflow.

What else you can automate

• Software Bill of Materials (SBOM) uploads: Upload the SBOM for each firmware version from the same pipeline, so vulnerability tracking always covers what you actually shipped.

• Device provisioning: Create ingestion keys and tag devices from your manufacturing or provisioning systems.

• Alerts and dashboards as code: Create alert rules and dashboards from scripts instead of clicking through the portal.

• Data export: Pull events and metrics into your own reporting tools.

• AI-assisted debugging: Give your AI assistant access to logs, metrics, and crash reports so it can help you find and fix firmware bugs. A dedicated Model Context Protocol (MCP) server is coming soon.

Get started

1. Generate an API key: In your workspace Settings, open API Keys and create a key with the scopes your automation needs. See Authentication.

2. Call the API: Pick the endpoints you need from the Management API reference. For example, this creates a firmware version and uploads its image:

For the full release pipeline, follow the Programmatic access guide.

Check our Roadmap. Join our community on Discord. Follow Spotflow on LinkedIn.

You can now deploy firmware updates over the air, straight from the Spotflow portal. Find a bug in the field, change the code, and roll the fix to every affected device without a truck roll or a site visit.

This closes the observability loop. Alongside logs, crash reports, metrics, dashboards, and alerts, you can now push firmware updates straight to your devices, so you can detect a problem, ship the fix, and verify the result all in one place.

How you can use Spotflow Over-the-air (OTA) Updates:

Deploy from the cloud: Upload a signed firmware image and roll it out to your fleet from one portal, no manual reflashing.

Target with deployment cohorts: Group devices manually or by Device Tags (location, hardware revision, any attribute), so you can pilot on a small cohort, verify the telemetry, then expand to the full fleet. Active deployments also apply to devices added to the cohort later.

Track every device to completion: See which devices succeeded, which are pending, and which failed, and retry the ones that need it.

Roll back automatically: The device boots the new image in test mode first. If your application doesn't confirm it, the next reboot reverts to the previous firmware, so a bad update can't strand a device in the field.

Integrate with minimal application code: The Spotflow device module handles the download, the image swap, and the reboot. Register update callbacks to delay the download or defer the reboot until a safe, idle window. The device-side integration is currently available for Zephyr.

Get started:

• Over-the-air (OTA) Updates Fundamentals

• Deploy OTA Updates — Step-by-Step Guide

• Over-the-air (OTA) updates with Zephyr

• Over-the-air (OTA) updates of external MCUs

Full walkthrough on the blog: Over-the-Air Firmware Updates on Zephyr RTOS with Spotflow

Check our Roadmap. Join our community on Discord.

You can now upload an SBOM to any firmware version, and Spotflow automatically matches its components against known CVEs and tracks which of your deployed devices are affected.

Cross-referencing dependency lists against CVE feeds by hand doesn't scale. Spotflow does the matching for you, re-scans as the CVE database changes, and gives your team a structured way to assess and document each finding.

What you can do

• Upload SBOMs per firmware version: SPDX 2 (tag-value) or SPDX 3 (JSON). Spotflow extracts the components and dependencies automatically.

• Get matched against known CVEs, continuously: Checked on upload, then re-scanned as the CVE database updates, so newly disclosed vulnerabilities surface in firmware you already shipped.

• Assess issues with VEX-style states: New findings start Not Assessed. Move each to In Triage, Affected, or Not Affected as your team investigates. Not Affected requires a justification.

• See fleet-wide impact at a glance: The Security overview lists every firmware version with open issues, how many devices are affected, and lets you filter by severity or CISA KEV status.

• Keep a full audit trail: Every assessment and ignore action is logged with who made it, when, and why.

Spotflow supports your CRA compliance work, but your organization is still responsible for determining which requirements apply and meeting them.

Read the full guide: Track security issues across your devices and Comply with CRA.

Check our Roadmap. Join our community on Discord.