Preview: the public API is not live yet. The guides are drafts shared before the first endpoints open and may change.

Introduction to the Corendis API

Draft. Requires product owner and CTO approval before publication.

What is it?

The Corendis public API is a REST interface that lets your own systems (web shop, marketplace connector, WMS, BI tool, partner application) exchange data with Corendis. The root path is /api/v1. The contract is published as OpenAPI 3.1.

The supported ways to connect to Corendis from outside are the public API, webhooks and events, and Excel/CSV import and export. Direct database access is never granted.

Contract guarantee

The contract under /api/v1 receives no breaking changes. Additive changes such as new fields or new endpoints may be made; changes that alter the meaning or format of an existing field are not.
Breaking changes are made only in a new major version (/api/v2).
After a new major version is released, the previous major version is supported for at least 12 months.
Details: Limits and versioning.

Machine names are in English

Machine-facing names in the public API are in English: paths, fields, parameters, webhook event names and file-template column keys. Column keys are fixed and language-independent. The human-readable text in errors (title) is not a contract; your program should decide based on type and code, not on the text.

General rules

Every resource has a single identifier: a lowercase, hyphenated UUID string. The business code (kod) is used as a filter and never replaces the identifier in the URL path.
Money and quantities use a decimal point; dates are ISO 8601 and timestamps are UTC.
The Idempotency-Key header is mandatory on POST requests. Repeating the same key with the same body does not create a second record; the same key with a different body returns 422.
Reading and export stay available even when a subscription has expired (see Errors).

Unsupported endpoints: `/api/ui`

The Corendis web application uses its own internal endpoints under /api/ui. They are not public, not documented, and change together with the web application without notice. The internal endpoints of the web interface are not supported; do not use them in your integration. Machine-client tokens are not accepted on those endpoints anyway.