Linkit

API Overview

Base URL, request format, authentication, pagination, filtering, and error handling

API Overview

The Linkit REST API provides programmatic access to your product catalog, inventory, orders, offers, customers, and payments. All endpoints follow consistent conventions for authentication, pagination, and error handling. Order read responses use a versioned envelope with a normalized order payload (Orders).


Base URL

Two spellings, one API. The same route table answers on both, against the same process, and neither is going away — use whichever reads better in your client:

https://linkit.works/api/v1
https://api.linkit.works/v1

The first is what the SDKs and the OpenAPI document below name. The second supplies the /api segment from the hostname instead of the path, which is what most people expect when they are handed "the API host"; the edge rewrites it onto the first, so a request is indistinguishable at the server.

v2.linkit.works appeared in earlier drafts of this page. It was never a version — it was the hostname of a parallel deployment during the migration, and it is not a supported base URL. If a client of yours has it baked in, point it at one of the two above.

All endpoints are prefixed with /api/v1 (or /v1 on api.linkit.works). HTTPS is required for all requests. The OpenAPI document is published at /docs/swagger.json (and served by the API itself at GET /api/v1/docs/swagger.json).

What this reference covers

This reference and the OpenAPI document describe the public /api/v1 API: authentication for API clients, products, branches, SKUs, orders, offers, categories, brands, generics, customers and customer groups, payment orders and payment providers, async job status, MCP, and the health probes. The dashboard's own endpoints, platform operations, App Store and per-app integration endpoints, and webhook receivers are not part of the public API and are not documented here.


Request Format

  • Content-Type: application/json for all request bodies
  • Character encoding: UTF-8
  • Date format: ISO 8601 / RFC 3339 (e.g., 2024-01-15T10:30:00Z)
  • IDs: 15-character alphanumeric strings (Linkit resource identifiers)

Authentication

Every request requires one of two authentication methods:

Bearer Token

Authorization: Bearer your_token_here

Obtained by authenticating with email and password. Tokens expire after a configurable period.

API Key

Authorization: your_api_key_here

Generated from the admin dashboard. Better suited for server-to-server communication.

See Authentication for full details.


HTTP Methods

MethodPurpose
GETRetrieve resources
POSTCreate resources or execute actions
PUTFull replacement update
PATCHPartial update
DELETERemove resources

Status Codes

CodeMeaning
200Success
201Created
204Deleted (no response body)
400Bad request (invalid input)
401Unauthorized (missing or invalid credentials)
403Forbidden (insufficient permissions)
404Resource not found
409Conflict (duplicate resource)
422Validation error
429Rate limit exceeded
500Internal server error
501Not implemented on this host (handler exists in a crate, nothing is mounted)

Pagination

List endpoints return paginated results:

{
  "data": [],
  "count": 25,
  "total_count": 1234,
  "page": 1,
  "limit": 25,
  "has_next": true,
  "meta": {}
}

Query Parameters

ParameterTypeDefaultDescription
pageinteger1Page number (1-indexed)
limitinteger20Items per page (max 100)

Sorting

Use the sort parameter for custom ordering:

GET /api/v1/products?sort=name_en
GET /api/v1/products?sort=-created

Prefix with - for descending order. Default sort is -created (newest first).


Filtering

Resources support field-level filtering through query parameters:

GET /api/v1/products?is_enabled=true&brand_id=brand_123
GET /api/v1/orders?status=delivered&source=salla
GET /api/v1/customers?type=vip&status=active

Most list endpoints support a search parameter for full-text search across relevant fields:

GET /api/v1/products?search=paracetamol

Error Response Format

All errors follow a consistent structure:

{
  "code": 400,
  "error": "Validation failed",
  "details": {
    "field": "name_en",
    "message": "Name is required"
  }
}
FieldTypeDescription
codeintegerHTTP status code
errorstringHuman-readable error message
detailsstring/objectAdditional context about the error

Rate Limiting

API requests are rate-limited per organization. When you exceed the limit, the API returns 429 Too Many Requests with a Retry-After header indicating how long to wait.

Standard limits:

ScopeLimit
Read endpoints300 requests/min
Write endpoints100 requests/min
Bulk operations100 requests/min

Common Patterns

Iterate All Pages

async function fetchAll(endpoint, token) {
  const results = [];
  let page = 1;
  let hasNext = true;

  while (hasNext) {
    const response = await fetch(
      `https://linkit.works/api/v1/${endpoint}?page=${page}&limit=100`,
      { headers: { 'Authorization': `Bearer ${token}` } }
    );
    const data = await response.json();
    results.push(...data.data);
    hasNext = data.has_next;
    page++;
  }

  return results;
}

Next Steps