COREADY
Create account

API

Connect your own systems: how to authenticate, how versioning works, and where the reference lives.

Coready has a JSON API so you can connect your own systems — an ERP, a warehouse, a custom storefront, a reporting tool, or anything else that needs your catalog and orders.

What you can reach

The API covers the same data you manage in the admin panel:

  • products, categories and manufacturers
  • options, option values and quantity-break prices
  • orders and counterparties
  • customers, countries and currencies
  • files and image uploads
  • your account settings, and your current plan and usage

Everything is scoped to your company. An API call sees exactly what your account sees — nothing from any other company on the platform.

Getting connected

Requests authenticate in one of two ways:

  • API key — send it as a bearer token: Authorization: Bearer <your key>. This is the right choice for a server, a scheduled job or another application.
  • Signed-in session — used by the admin panel itself in your browser.

Ask us to issue an API key for your company; keep it on a server you control and never ship it in a website or mobile app, where anyone can read it.

Versioning

The API is versioned in the URL, so a call you write today keeps working. We add fields and endpoints to a version; we do not remove or rename anything inside one. When something has to change incompatibly, it arrives as a new version and the old one keeps running while you move across.

Responses

Every response has the same shape, so you can handle success and failure in one place.

Success:

{ "data": { "id": "…" }, "meta": null, "error": null }

Failure:

{ "data": null, "meta": null, "error": { "code": "VALIDATION_ERROR", "message": "…" } }

What the error codes mean

CodeStatusWhat happened
VALIDATION_ERROR400Something in the request was missing or malformed. The message names the field.
UNAUTHORIZED401No credentials, or they were not recognised.
PLAN_LIMIT_EXCEEDED402Creating this would go past your plan's limit.
FORBIDDEN403Your account is not allowed to do this.
NOT_FOUND404No such record, or it belongs to another company.
CONFLICT409It clashes with something that already exists — a duplicate code, usually.
PRECONDITION_FAILED412The record changed since you read it. Fetch it again and retry.
RATE_LIMITED429Too many requests too quickly. Slow down and retry.
SERVER_ERROR500Something went wrong on our side.

PLAN_LIMIT_EXCEEDED only ever refuses a create. Reading, updating and deleting keep working, so an integration never loses access to data you already have. The message names the limit you hit and your current usage — see Plans and limits.

Retrying safely

For requests that create something, send an Idempotency-Key header with a value you generate. If a reply never arrives and you retry with the same key, you get the original result instead of a second copy. Keys are remembered for 24 hours.

Rate limits

Requests are rate limited per client. Staying under a few requests per second is comfortable for normal syncing; if you are importing in bulk, spread the work out rather than sending it all at once. A RATE_LIMITED response means wait briefly and try again.

Reference