Changelog

2026-11-06

Webhooks

/api/v1/webhooks registers https endpoints for order, shipment, invoice, credit memo, payment and return events, with a signing secret shown once, a test event per type, delivery logs and secret rotation. Needs a key with the webhooks:manage scope.
Deliveries carry Balaji-Signature: t=<unix seconds>,v1=<HMAC-SHA256 hex>. Sending stays off until Balaji turns it on. New code: WEBHOOKS_UNAVAILABLE.

2026-11-06

Release window and order cancel

A live POST /api/v1/orders no longer waits for checkout. It answers 202 with result pending_release and release_after, and the order goes to the warehouse queue 30 minutes later. It no longer answers 201, and checkout refusals no longer come back on the POST: they show as error_code on GET /api/v1/orders/{po_number}.
DELETE /api/v1/orders/{po_number} cancels an order while it is held or in its release window. New codes: CANCEL_WINDOW_CLOSED and ORDER_NOT_PLACED.
GET /api/v1/orders/{po_number} also shows an accepted order that is not a sales order yet: status held, pending_release, cancelled or failed, with holds, release_after and error_code.

2026-11-06

Exports and scheduled feeds

Download orders, shipments, invoices, credit memos, payments, returns, the statement and the catalog from your Integrations page as CSV, Excel or PDF.
Scheduled feeds deliver CSV or Excel by email link, SFTP or a Google Sheets IMPORTDATA link. Feed links are /api/feeds/sheets/{token} and /api/feeds/download/{token}. New codes: EXPORT_TOO_LARGE and FEEDS_DISABLED. Delivery stays off until Balaji switches feeds on.

2026-11-06

Webhooks guide

The docs now cover webhook events, signature verification with samples in curl, JavaScript and Python, retries, and the new error codes INVALID_URL, TOO_MANY_ENDPOINTS, ENDPOINT_DISABLED and WEBHOOKS_PAUSED.

2026-11-06

MCP server for AI assistants

POST /api/mcp is a read-only MCP server over the same reads as /api/v1. Sign in with a key or with OAuth from Claude or ChatGPT. Ten tools: orders, shipments, invoices, credit memos, payments, returns, statement and catalog search.

2026-11-06

Developer docs, spec and terms

openapi.yaml describes every /api/v1 route and is checked against the handlers in CI.
Docs at /integrations/api with a quickstart, guides, reference, error codes and limits, and a Postman collection.
API terms and data-use terms at /integrations/terms. The text is a draft until approved.

2026-11-05

Order holds and daily ceilings

POST /api/v1/orders holds an order that looks wrong and answers 202 with result held and a holds list: LINE_QUANTITY_ABOVE_HISTORY, ORDER_TOTAL_ABOVE_HISTORY, CASE_PACK_ROUNDED. Nothing reaches checkout until a person releases it.
A quantity that is not a whole number of case packs is now held with CASE_PACK_ROUNDED instead of being rounded up.
Each key has a daily ceiling of orders, units and dollars. An order past it answers 429 DAILY_LIMIT_REACHED and places nothing.

2026-11-05

Store map, dry run and scopes

GET and PUT /api/v1/ship-to-map map your store codes to ship-to address ids.
POST /api/v1/orders takes ship_to.store_id. An order that names a store and a different address is refused with SHIP_TO_STORE_MISMATCH. New codes: UNKNOWN_STORE, STORE_ID_REQUIRED, DUPLICATE_STORE.
POST /api/v1/orders?dry_run=true returns what would be placed on any key and saves nothing.
Keys carry scopes: catalog:read, orders:read, shipments:read, finance:read, orders:write. A key without the scope gets INSUFFICIENT_SCOPE with required_scope.
Every response carries X-Request-Id. Limits are 120 requests a minute and 50,000 a day per key.

2026-11-05

Finance reads

GET /api/v1/invoices, /invoices/{invoice_id}, /invoices/{invoice_id}/pdf, /credit-memos, /payments, /returns and /statement. All money is whole cents with a currency.

2026-11-05

Full catalog sync

GET /api/v1/catalog returns every item you can order with updated_since paging, on_order and backorderable. Separate daily allowance of 50,000 rows.

2026-11-05

Orders and shipments from every channel

GET /api/v1/orders, /orders/by-number/{order_number} and /shipments read from the mirror, for your account and its sub-accounts, with updated_since and cursor paging.
GET /api/v1/items adds unit_price_cents, currency and next_arrival_date.

2026-11-01

Parts lookup and partner platforms

GET /api/v1/items looks up parts by SKU, UPC or search text, at your own price.
Partner platforms connect shops with OAuth: POST /api/v1/oauth/token and /api/v1/oauth/revoke.

2026-09-25

Order API

POST /api/v1/orders places a PO. GET /api/v1/orders/{po_number} reads its status and tracking. GET /api/v1/ship-tos lists your addresses.

Coming

EDI setup requests from your Integrations page.

Changelog

2026-11-06

Webhooks

/api/v1/webhooks registers https endpoints for order, shipment, invoice, credit memo, payment and return events, with a signing secret shown once, a test event per type, delivery logs and secret rotation. Needs a key with the webhooks:manage scope.
Deliveries carry Balaji-Signature: t=<unix seconds>,v1=<HMAC-SHA256 hex>. Sending stays off until Balaji turns it on. New code: WEBHOOKS_UNAVAILABLE.

2026-11-06

Release window and order cancel

A live POST /api/v1/orders no longer waits for checkout. It answers 202 with result pending_release and release_after, and the order goes to the warehouse queue 30 minutes later. It no longer answers 201, and checkout refusals no longer come back on the POST: they show as error_code on GET /api/v1/orders/{po_number}.
DELETE /api/v1/orders/{po_number} cancels an order while it is held or in its release window. New codes: CANCEL_WINDOW_CLOSED and ORDER_NOT_PLACED.
GET /api/v1/orders/{po_number} also shows an accepted order that is not a sales order yet: status held, pending_release, cancelled or failed, with holds, release_after and error_code.

2026-11-06

Exports and scheduled feeds

Download orders, shipments, invoices, credit memos, payments, returns, the statement and the catalog from your Integrations page as CSV, Excel or PDF.
Scheduled feeds deliver CSV or Excel by email link, SFTP or a Google Sheets IMPORTDATA link. Feed links are /api/feeds/sheets/{token} and /api/feeds/download/{token}. New codes: EXPORT_TOO_LARGE and FEEDS_DISABLED. Delivery stays off until Balaji switches feeds on.

2026-11-06

Webhooks guide

The docs now cover webhook events, signature verification with samples in curl, JavaScript and Python, retries, and the new error codes INVALID_URL, TOO_MANY_ENDPOINTS, ENDPOINT_DISABLED and WEBHOOKS_PAUSED.

2026-11-06

MCP server for AI assistants

POST /api/mcp is a read-only MCP server over the same reads as /api/v1. Sign in with a key or with OAuth from Claude or ChatGPT. Ten tools: orders, shipments, invoices, credit memos, payments, returns, statement and catalog search.

2026-11-06

Developer docs, spec and terms

openapi.yaml describes every /api/v1 route and is checked against the handlers in CI.
Docs at /integrations/api with a quickstart, guides, reference, error codes and limits, and a Postman collection.
API terms and data-use terms at /integrations/terms. The text is a draft until approved.

2026-11-05

Order holds and daily ceilings

POST /api/v1/orders holds an order that looks wrong and answers 202 with result held and a holds list: LINE_QUANTITY_ABOVE_HISTORY, ORDER_TOTAL_ABOVE_HISTORY, CASE_PACK_ROUNDED. Nothing reaches checkout until a person releases it.
A quantity that is not a whole number of case packs is now held with CASE_PACK_ROUNDED instead of being rounded up.
Each key has a daily ceiling of orders, units and dollars. An order past it answers 429 DAILY_LIMIT_REACHED and places nothing.

2026-11-05

Store map, dry run and scopes

GET and PUT /api/v1/ship-to-map map your store codes to ship-to address ids.
POST /api/v1/orders takes ship_to.store_id. An order that names a store and a different address is refused with SHIP_TO_STORE_MISMATCH. New codes: UNKNOWN_STORE, STORE_ID_REQUIRED, DUPLICATE_STORE.
POST /api/v1/orders?dry_run=true returns what would be placed on any key and saves nothing.
Keys carry scopes: catalog:read, orders:read, shipments:read, finance:read, orders:write. A key without the scope gets INSUFFICIENT_SCOPE with required_scope.
Every response carries X-Request-Id. Limits are 120 requests a minute and 50,000 a day per key.

2026-11-05

Finance reads

GET /api/v1/invoices, /invoices/{invoice_id}, /invoices/{invoice_id}/pdf, /credit-memos, /payments, /returns and /statement. All money is whole cents with a currency.

2026-11-05

Full catalog sync

GET /api/v1/catalog returns every item you can order with updated_since paging, on_order and backorderable. Separate daily allowance of 50,000 rows.

2026-11-05

Orders and shipments from every channel

GET /api/v1/orders, /orders/by-number/{order_number} and /shipments read from the mirror, for your account and its sub-accounts, with updated_since and cursor paging.
GET /api/v1/items adds unit_price_cents, currency and next_arrival_date.

2026-11-01

Parts lookup and partner platforms

GET /api/v1/items looks up parts by SKU, UPC or search text, at your own price.
Partner platforms connect shops with OAuth: POST /api/v1/oauth/token and /api/v1/oauth/revoke.

2026-09-25

Order API

POST /api/v1/orders places a PO. GET /api/v1/orders/{po_number} reads its status and tracking. GET /api/v1/ship-tos lists your addresses.

Coming

EDI setup requests from your Integrations page.