Developer
24 routes. Paths are relative to https://api.intersink.com/v1.
- GET/developer/channels/{channelId}/apiIs the API enabled, can live keys be used (business verified), and the scopes the installed apps open
- GET/developer/channels/{channelId}/api-keysList the channel's API keys (metadata only)
- POST/developer/channels/{channelId}/api-keysCreate an API key. The secret `key` is returned only once.
- PATCH/developer/channels/{channelId}/api-keys/{id}Rename / change scopes, IP allow-list or expiry
- DELETE/developer/channels/{channelId}/api-keys/{id}Revoke an API key (immediate, irreversible)
- POST/developer/channels/{channelId}/api-keys/{id}/rotateIssue a replacement key (same settings); the old one is revoked now or after grace_seconds
- POST/developer/channels/{channelId}/api/app-keysCreate a publishable app key (X-App-Key) for the channel's own mobile or web app. It is returned once; it names the channel and meters usage, and grants nothing by itself
- GET/developer/channels/{channelId}/api/app-keys/{keyId}Show a publishable app key again (channel managers; audited). Secret keys are never shown again.
- POST/developer/channels/{channelId}/api/disableDisable the channel's API: its keys stop at once
- POST/developer/channels/{channelId}/api/enableEnable the channel's API (businesses created on Intersink)
- GET/developer/channels/{channelId}/auditAudit log of API key and webhook changes (newest first)
- GET/developer/channels/{channelId}/webhooksList the channel's webhook endpoints
- POST/developer/channels/{channelId}/webhooksRegister an https endpoint. The signing `secret` is returned only here and on rotation.
- GET/developer/channels/{channelId}/webhooks/{id}One webhook endpoint
- PATCH/developer/channels/{channelId}/webhooks/{id}Change URL / events, or enable / disable
- DELETE/developer/channels/{channelId}/webhooks/{id}Delete an endpoint (and its delivery log)
- GET/developer/channels/{channelId}/webhooks/{id}/deliveriesDelivery log of an endpoint (newest first, paged)
- GET/developer/channels/{channelId}/webhooks/{id}/deliveries/{deliveryId}One delivery with its payload and response body
- POST/developer/channels/{channelId}/webhooks/{id}/deliveries/{deliveryId}/redeliverSend a past delivery's event again, now (same event id)
- POST/developer/channels/{channelId}/webhooks/{id}/rotate-secretNew signing secret (old one optionally kept for a grace period)
- POST/developer/channels/{channelId}/webhooks/{id}/testSend a webhook.ping event now and return the result
- GET/developer/event-typesEvent types a webhook endpoint can subscribe to
- GET/developer/scopesScopes an API key can be granted
- GET/openapi.jsonOpenAPI 3 description of the Kodkila API (v1)
Is the API enabled, can live keys be used (business verified), and the scopes the installed apps open
GET/developer/channels/{channelId}/api
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Response
200. The payload in data is not described in the spec yet.
List the channel's API keys (metadata only)
GET/developer/channels/{channelId}/api-keys
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Response
200. data is object[].
Create an API key. The secret `key` is returned only once.
POST/developer/channels/{channelId}/api-keys
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| namerequired | string | At least 1 characters, at most 100 characters. Example: "Warehouse sync" |
| mode | string | One of: "live", "test". |
| project_id | string | A developer project the key belongs to (third-party and Marketplace apps). Without one, it is the channel's own key (Settings › API). |
| scopesrequired | string[] | One of: "products:read", "products:write", "orders:read", "orders:write", "customers:read", "crm:read", "crm:write", "e2ee:gateway", "channel:config:read", "releases:write", "updates:write", "profile_data:read", "search:read", "search:write", "search:admin", "media:read", "media:write", "features:read", "features:write", "jobs:apply". |
| app_id | string | Developer app this key belongs to (/app-builder). Its scopes must be covered by the app's capabilities. |
| ip_allowlist | string[] | Only these IPs / CIDR blocks may use the key; empty = any |
| expires_at | string | Example: "2027-01-01T00:00:00Z" |
Response
201. The payload in data is of type object.
Rename / change scopes, IP allow-list or expiry
PATCH/developer/channels/{channelId}/api-keys/{id}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| name | string | At least 1 characters, at most 100 characters. |
| scopes | string[] | One of: "products:read", "products:write", "orders:read", "orders:write", "customers:read", "crm:read", "crm:write", "e2ee:gateway", "channel:config:read", "releases:write", "updates:write", "profile_data:read", "search:read", "search:write", "search:admin", "media:read", "media:write", "features:read", "features:write", "jobs:apply". |
| ip_allowlist | string[] | [] clears the list |
| expires_at | string | null = never expires |
| app_id | string | Developer app this key belongs to (/app-builder). Its scopes must be covered by the app's capabilities. |
Response
200. The payload in data is of type object.
Revoke an API key (immediate, irreversible)
DELETE/developer/channels/{channelId}/api-keys/{id}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Response
200. The payload in data is of type object.
Issue a replacement key (same settings); the old one is revoked now or after grace_seconds
POST/developer/channels/{channelId}/api-keys/{id}/rotate
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| grace_seconds | number | Seconds the OLD key keeps working (0 = revoke it immediately) Minimum 0, maximum 604800. |
Response
201. The payload in data is of type object.
Create a publishable app key (X-App-Key) for the channel's own mobile or web app. It is returned once; it names the channel and meters usage, and grants nothing by itself
POST/developer/channels/{channelId}/api/app-keys
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| namerequired | string | At least 1 characters, at most 100 characters. Example: "iOS and Android app" |
| mode | string | One of: "live", "test". |
Response
201. The payload in data is of type object.
Show a publishable app key again (channel managers; audited). Secret keys are never shown again.
GET/developer/channels/{channelId}/api/app-keys/{keyId}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| keyIdrequired | string, path |
Response
200. The payload in data is not described in the spec yet.
Disable the channel's API: its keys stop at once
POST/developer/channels/{channelId}/api/disable
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Response
201. The payload in data is not described in the spec yet.
Enable the channel's API (businesses created on Intersink)
POST/developer/channels/{channelId}/api/enable
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Response
201. The payload in data is not described in the spec yet.
Audit log of API key and webhook changes (newest first)
GET/developer/channels/{channelId}/audit
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| page | number, query | Minimum 1. |
| limit | number, query | Minimum 1, maximum 100. |
Response
200. data is object[].
List the channel's webhook endpoints
GET/developer/channels/{channelId}/webhooks
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Response
200. data is object[].
Register an https endpoint. The signing `secret` is returned only here and on rotation.
POST/developer/channels/{channelId}/webhooks
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| urlrequired | string | At most 2048 characters. Example: "https://example.com/hooks/kodkila" |
| description | string | At least 0 characters, at most 255 characters. |
| eventsrequired | string[] | One of: "order.created", "order.status_changed", "order.paid", "payment.succeeded", "payment.failed", "payment.refunded", "payment.disputed", "product.created", "product.updated", "product.deleted", "cms.surface.published", "cms.surface.unpublished", "media.asset.ready", "media.asset.failed", "media.track.ready", "webhook.ping", "*". |
Response
201. The payload in data is of type object.
One webhook endpoint
GET/developer/channels/{channelId}/webhooks/{id}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Response
200. The payload in data is of type object.
Change URL / events, or enable / disable
PATCH/developer/channels/{channelId}/webhooks/{id}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| url | string | At most 2048 characters. |
| description | string | At least 0 characters, at most 255 characters. |
| events | string[] | One of: "order.created", "order.status_changed", "order.paid", "payment.succeeded", "payment.failed", "payment.refunded", "payment.disputed", "product.created", "product.updated", "product.deleted", "cms.surface.published", "cms.surface.unpublished", "media.asset.ready", "media.asset.failed", "media.track.ready", "webhook.ping", "*". |
| status | string | Re-enabling resets the consecutive-failure counter One of: "enabled", "disabled". |
Response
200. The payload in data is of type object.
Delete an endpoint (and its delivery log)
DELETE/developer/channels/{channelId}/webhooks/{id}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Response
200. The payload in data is not described in the spec yet.
Delivery log of an endpoint (newest first, paged)
GET/developer/channels/{channelId}/webhooks/{id}/deliveries
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path | |
| status | string, query | One of: "pending", "succeeded", "failed". |
| page | number, query | Minimum 1. |
| limit | number, query | Minimum 1, maximum 100. |
Response
200. The payload in data is not described in the spec yet.
One delivery with its payload and response body
GET/developer/channels/{channelId}/webhooks/{id}/deliveries/{deliveryId}
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path | |
| deliveryIdrequired | string, path |
Response
200. The payload in data is of type object.
Send a past delivery's event again, now (same event id)
POST/developer/channels/{channelId}/webhooks/{id}/deliveries/{deliveryId}/redeliver
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path | |
| deliveryIdrequired | string, path |
Response
201. The payload in data is of type object.
New signing secret (old one optionally kept for a grace period)
POST/developer/channels/{channelId}/webhooks/{id}/rotate-secret
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Request body application/json
| Field | Type | Description |
|---|---|---|
| grace_seconds | number | Seconds deliveries are ALSO signed with the old secret Minimum 0, maximum 604800. |
Response
201. The payload in data is of type object.
Send a webhook.ping event now and return the result
POST/developer/channels/{channelId}/webhooks/{id}/test
Needs a signed-in user (Bearer token or access_token cookie).
Parameters
| Name | Type | Description |
|---|---|---|
| channelIdrequired | string, path | |
| idrequired | string, path |
Response
201. The payload in data is of type object.
Event types a webhook endpoint can subscribe to
GET/developer/event-types
Public: no sign-in needed.
Response
200. The payload in data is not described in the spec yet.
Scopes an API key can be granted
GET/developer/scopes
Public: no sign-in needed.
Response
200. The payload in data is not described in the spec yet.
OpenAPI 3 description of the Kodkila API (v1)
GET/openapi.json
Public: no sign-in needed.
Raw OpenAPI document. servers lists https://api-dev.kodkila.com/v1 (development, live) and https://api.kodkila.com/v1 (production, not live yet); paths are relative to them.
Response
200. The payload in data is not described in the spec yet.