Everything between someone asking for a laptop and that laptop arriving, in one place.
TypeScriptReact 19Vite 7Tailwind 3Express 4MySQL 8.4 on Cloud SQLSnipe-IT 8.8 APIMicrosoft Entra IDGoogle Cloud RunDockerGitLab CISonarQube
Built for the IT asset team of a dental support organisation and in daily use since October 2026. The source is private. The screenshots are the real app on the live database, with every person's name replaced before the shot.
A year ago the asset team ran shipping out of one shared workbook: 1,711 lines typed by hand in nine months, 118 department codes written 328 different ways, no price or total anywhere, and nearly three in ten lines with no ticket number. Snipe-IT held about 13,000 records, mostly imports from field support's own spreadsheets, while the device-management and security tools could see roughly 40,000 devices that had no asset record at all.
Census started in January 2026 as 22 screens in front of Snipe-IT's API, where you signed in by pasting your own key. It is now the console the team works in all day: onboarding, shipping, offboarding, chargebacks, audits, repairs, disposals, reports, and a set of jobs that run every morning, evening and week, and every five minutes for tickets. Snipe-IT stays the system of record, self-hosted on Google Cloud since October. Census reads it by SQL and writes to it through the API as the person who clicked.
Where it started: the shipping tab of the old workbook, Sep 2025 to Jun 2026. Names, tickets and tags replaced.
What it does
New gear arrives already on a list
The morning run reads SHI's orders, lines and shipments. A delivered unit lands on the onboarding queue with its order number, supplier and owner filled in; a tech checks it against the box in their hand and presses Create. The rule the whole app follows: the computer suggests, a person confirms. 910 assets came in this way in its first two weeks.
A FedEx label from the checkout
Checking a device out to someone opens the label form filled with the person, the address Census found in their ticket, the ticket number and the gear. FedEx validates the address, prints the label, and every box is tracked until it lands; the delivery date is written back onto the asset and a note goes on the ServiceNow ticket at each step.
Getting gear back when people leave
The call center marks a leaver and the Returns list shows what they hold. A tech checks each item in with its condition, Good or Broken, and Census does the check-ins and the stock counts. Anything not returned keeps its last holder and ticket, so it can still be chased or charged back. It replaced a spreadsheet called Callcenter.xlsx.
Chargebacks with a record of every charge
Each month, per owning team: every item handed out, reviewed by a manager, charged in one press, and the same billing file finance always read. Nothing can be charged twice, and the department comes from the person's record instead of being typed. 4,502 charges since January; the old workbook held no price, cost or total anywhere.
Every night, the fleet is checked against the tools
The evening run compares the books with what Intune, Jamf and CrowdStrike can see and raises a flag for what does not add up: missing from a tool, falling off one, still reporting after disposal, two computers on one person. Flags are routed to a group, escalated when they need the next tier, and close on their own once the fact changes.
Signed in as yourself, all the way down
Sign-in is Microsoft Entra ID. The gateway exchanges the person's token for their own Snipe-IT access, so every write lands in Snipe-IT's history under their name, not a service account's. Roles come from directory groups; thirteen smaller groups gate the workspaces (VIP, Security, Call Center, Chargebacks, audits, catalog edits).
Asset onboarding: what SHI delivered yesterday, waiting for a tech to confirm.
Left, the ServiceNow queue inside Census. Right, what the ticket sees: Census writes the checkout and the label back as notes.
In numbers
Changes made through Census, per month
Rows in Snipe-IT's own history that came through the app. The team moved onto it fully on 22 October.
Commits per month
3,224 on main from 13 January to 5 November 2026, one author.
Hours a month given back
Minutes per task agreed by the team, times October's real counts. About 314 hours in all, close to two people's month.
Active assets on the books48,243
People in it each week36
Outside systems connected14
Built and waiting on a switch4
Screens in the app53
API routes228
Reads moved from API to SQL41
Census tables in the database40
Commits since 13 January 20263,224
Lines of code, tests included294,500
Test files716
Design specs and plans written239
Database and git read on 5 November 2026.
The outside systems
Snipe-ITThe record. Read by SQL from its own database; written through its REST API as the signed-in person.
Microsoft Entra IDSign-in with MSAL, roles from groups, on-behalf-of exchange for each person's Snipe-IT access; new hires read nightly.
Microsoft IntuneWindows devices through Graph: last check-in, user, OS, MAC, IP; missing and falling-off flags.
Jamf ProMacs and iPads: last seen, user, IP; the iPad network check.
CrowdStrike FalconComputers running the sensor and their IPs; the location check and the Not on CrowdStrike tab.
ServiceNowTickets synced every five minutes, requests queue, work notes and comments, incident creation, VIP flag, sites.
ServiceNow CMDBA daily map from configuration items to assets; a compare report; 6,658 retired devices imported.
FedExShip, Track and Address Validation: labels, returns, tracking, delivery dates.
SHIOrders, lines, shipments and tracking numbers, read each morning into the onboarding queue.
Apple, Dell, LenovoApple Business Manager, Dell TechDirect and Lenovo warranty lookups, paced to one ask per asset a month.
phpIPAMSubnets per site, read for location checks and printer placement.
EpturaSeats, buildings and the meeting-room floor plans behind the Audio Visual map.
Ricoh fleet reportThe daily printer report from a service mailbox; new printers created and placed by IP.
Microsoft Graph mailReads the Ricoh and Workday reports; sends warning emails when switched on.
Google CloudCloud Run for the app and the jobs, Cloud SQL for the database, Cloud Logging, Secret Manager.
WorkdayNew-hire and leaver lists. Built, waiting on the reports reaching the mailbox.
Active DirectoryComputer objects and last logon, and the Room Check pilot. Built, waiting on a service account.
Avigilon AltaDoor access for new hires. Next: a service role is set up, the code is not written.
Every vendor connector is read-only toward its vendor. Census writes to Snipe-IT, to ServiceNow (notes, comments, incidents) and to FedEx (labels), and nowhere else.
How it runs
Three packages in one repository: the web app, the Express gateway, and the services package that holds the connectors and the jobs. The gateway serves the compiled app as static files from one Cloud Run service; a Cloud Run job runs the Morning (06:00), End-of-day (19:00) and Weekly (Sunday) runs and the five-minute ServiceNow poll. Snipe-IT 8.8 runs on a Compute Engine VM with its MySQL 8.4 database on Cloud SQL, private only, and Census's own 40 tables live in that same database under a tag_ prefix, built by 50 migrations.
People write by API, the jobs by SQL. A job never creates an asset or checks anything in or out: it queues a candidate, a person confirms, and the app writes through the API as that person, so Snipe-IT's history names who did what. Reads went the other way: 41 read surfaces moved from the API to SQL between 16 and 21 October, each checked against the API's answer before it was switched on. The VIP report went from about two minutes to about a second; a year of history from 19.5 minutes to 1.3 seconds.
Nothing is served to someone who is not signed in. A Strict session cookie guards the API and a Lax page cookie guards the pages and the bundle, both set at sign-in and named with the __Host- prefix in production. Helmet sets the content security policy, bodies are capped at 10 kb, and traffic is rate-limited on three tiers. The 716 self-test files run with one command and the GitLab pipeline runs them on every push; SonarQube went from 43 blocker and critical findings to none in the November security pass.
The weekly report: every transaction in Snipe-IT for the week, with the columns you pick, exported to Excel in one press.
What is next
Room Check is built and tested: a small window on each field desktop asks whoever is sitting there whether the PC is still at that site and in that room, and nothing changes until a manager approves the answer. A pilot on a handful of desktops comes next. After it, the Workday new-hire and leaver lists inside Census, door access for new hires through Avigilon Alta, and writing what Census knows back into the ServiceNow CMDB.
The honest gap is cost data: only about one asset in twenty carries a purchase cost, so the chargeback totals are a floor. The onboarding queue now fills the order number and supplier on 87 percent of new assets, against under one percent before, which is how that gap closes over time.
Room Check, the next piece: built and tested, pilot next.
I built Census with an AI coding assistant as a pair, and a large share of the work is the 92,912 lines of tests that keep it from breaking. The 239 design specs and plans in the repository are the record of the decisions.
Snipe-IT is a trademark of Grokability, Inc. Census integrates with it through its public REST API and its database and is not affiliated with or endorsed by Grokability. Icons on this page: Solar by 480 Design (CC BY 4.0), the set the app uses.