Connect inventory to the systems your business uses.

Authentication

A business owner creates and revokes API keys at Integrations. Keys are business-scoped, stored as SHA-256 hashes, expire after a selected period, and are shown in full only once. Keep the token in a server-side secret store and send it over HTTPS:

Authorization: Bearer inv_live_<one-time-token>

Never put keys in a URL, browser bundle, or source control. A key is disabled when it expires, is revoked, or its creating membership becomes inactive. Invalid keys return 401; a missing permission returns 403.

Permissions

Grant only the permissions the connection needs. catalog:read does not expose unit costs; reports:read permits aggregate inventory valuation by location.

Endpoints

Pagination and stock units

GET /api/v1/products returns pages of up to 200 active products. Continue with meta.nextCursor while meta.hasMore is true; the first response also includes meta.totalCount. Search uses the q parameter across product name, SKU, and barcode.

Each balance includes its location and unit of measure. Keep different units separate; do not total boxes, kilograms, meters, or other unlike units together.

Start with a configurable catalog item

Define business-specific fields once, then attach their values to products. The same catalog supports goods, parts, materials, and supplies; category names and units are data configured for each business.

For example, add a text field for a shelf location:

curl --request POST "$INVENTORY_API_URL/api/v1/catalog/attributes" \
  --header "Authorization: Bearer $INVENTORY_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"label":"Shelf","dataType":"TEXT"}'

Then create an item with its own SKU, unit, reorder point, and configured field value:

curl --request POST "$INVENTORY_API_URL/api/v1/products" \
  --header "Authorization: Bearer $INVENTORY_API_KEY" \
  --header "Content-Type: application/json" \
  --data '{"name":"Steel fastener","sku":"HW-028","categoryName":"Hardware","unitOfMeasure":"box","reorderPoint":5,"customAttributes":{"shelf":"A-12"}}'

The product starts with a zero balance at each active location. Record its opening quantity with a stock receipt and an idempotency key, or use the CSV import preview for an existing catalog.

Reliable stock changes

Stock movement requests require a positive decimal quantity, location, compatible reason, and UUID idempotencyKey. Retry uncertain requests with the same key and exact same request body. Reusing a key for a different change or reducing stock below zero returns 409.

Product alternate units convert into the product base unit. Configure them at /api/v1/products/{productId}/units, then pass the selected unitId when recording a stock movement. Balances stay in the base unit, and each movement stores the entered quantity, unit, and conversion factor used. Existing requests without a unitId continue to use the base unit.

Location transfers also accept an optional alternate unit and record paired base-unit movements atomically. API changes use the same tenant checks and audit history as workspace activity.

Inventory valuation

GET /api/v1/reports/valuation?locationId=<id> requires reports:read and returns the estimated value of positive on-hand stock, the configured business currency, and counts of valued and missing-cost items. It does not expose per-product unit costs. Workspace sessions must belong to an owner, admin, or manager to read valuation.

Location time zones

Locations include an IANA time zone, such as America/Chicago. Create requests may provide one; the API defaults to UTC when omitted. Authorized users can update it later. Movement-report daily totals follow that location time zone.

Response format

Successful responses use { "success": true, "data": ... }. Errors use { "success": false, "error": "..." }. Organization scope comes from the session or API key; clients cannot choose another business by sending an organization ID.

Movement reports accept locationId, days from 1 to 365, and an optional cursor. Each page contains up to 50 movement details; pass meta.nextCursor unchanged to load older activity. The full-period count, unit totals, and location-timezone daily chart totals are included with every page.

Compatibility and limits

API keys are limited to 120 requests per fixed minute by default. Configure `INVENTORY_API_REQUESTS_PER_MINUTE` to set a positive limit up to 100000; throttled responses return `429` and `Retry-After`. No availability guarantee is published. Targeted tenant-isolation and selected role/session checks pass locally. A full permission matrix, support and deprecation policy, and external edge protection remain before production integrations.

For the current request schemas and additional operations, see the repository’s docs/API.md.