API Overview
Base URL, request format, authentication, pagination, filtering, and error handling
API Overview
The Linkit REST API provides programmatic access to your product catalog, inventory, orders, offers, customers, and payments. All endpoints follow consistent conventions for authentication, pagination, and error handling. Order read responses use a versioned envelope with a normalized order payload (Orders).
Base URL
Two spellings, one API. The same route table answers on both, against the same process, and neither is going away — use whichever reads better in your client:
https://linkit.works/api/v1
https://api.linkit.works/v1The first is what the SDKs and the OpenAPI document below name. The second
supplies the /api segment from the hostname instead of the path, which is what
most people expect when they are handed "the API host"; the edge rewrites it
onto the first, so a request is indistinguishable at the server.
v2.linkit.works appeared in earlier drafts of this page. It was never a
version — it was the hostname of a parallel deployment during the migration,
and it is not a supported base URL. If a client of yours has it baked in,
point it at one of the two above.
All endpoints are prefixed with /api/v1 (or /v1 on api.linkit.works). HTTPS is required for all requests. The OpenAPI document is published at /docs/swagger.json (and served by the API itself at GET /api/v1/docs/swagger.json).
What this reference covers
This reference and the OpenAPI document describe the public /api/v1 API:
authentication for API clients, products, branches, SKUs, orders, offers,
categories, brands, generics, customers and customer groups, payment orders
and payment providers, async job status, MCP, and the health probes. The
dashboard's own endpoints, platform operations, App Store and per-app
integration endpoints, and webhook receivers are not part of the public API
and are not documented here.
Request Format
- Content-Type:
application/jsonfor all request bodies - Character encoding: UTF-8
- Date format: ISO 8601 / RFC 3339 (e.g.,
2024-01-15T10:30:00Z) - IDs: 15-character alphanumeric strings (Linkit resource identifiers)
Authentication
Every request requires one of two authentication methods:
Bearer Token
Authorization: Bearer your_token_hereObtained by authenticating with email and password. Tokens expire after a configurable period.
API Key
Authorization: your_api_key_hereGenerated from the admin dashboard. Better suited for server-to-server communication.
See Authentication for full details.
HTTP Methods
| Method | Purpose |
|---|---|
GET | Retrieve resources |
POST | Create resources or execute actions |
PUT | Full replacement update |
PATCH | Partial update |
DELETE | Remove resources |
Status Codes
| Code | Meaning |
|---|---|
200 | Success |
201 | Created |
204 | Deleted (no response body) |
400 | Bad request (invalid input) |
401 | Unauthorized (missing or invalid credentials) |
403 | Forbidden (insufficient permissions) |
404 | Resource not found |
409 | Conflict (duplicate resource) |
422 | Validation error |
429 | Rate limit exceeded |
500 | Internal server error |
501 | Not implemented on this host (handler exists in a crate, nothing is mounted) |
Pagination
List endpoints return paginated results:
{
"data": [],
"count": 25,
"total_count": 1234,
"page": 1,
"limit": 25,
"has_next": true,
"meta": {}
}Query Parameters
| Parameter | Type | Default | Description |
|---|---|---|---|
page | integer | 1 | Page number (1-indexed) |
limit | integer | 20 | Items per page (max 100) |
Sorting
Use the sort parameter for custom ordering:
GET /api/v1/products?sort=name_en
GET /api/v1/products?sort=-createdPrefix with - for descending order. Default sort is -created (newest first).
Filtering
Resources support field-level filtering through query parameters:
GET /api/v1/products?is_enabled=true&brand_id=brand_123
GET /api/v1/orders?status=delivered&source=salla
GET /api/v1/customers?type=vip&status=activeText Search
Most list endpoints support a search parameter for full-text search across relevant fields:
GET /api/v1/products?search=paracetamolError Response Format
All errors follow a consistent structure:
{
"code": 400,
"error": "Validation failed",
"details": {
"field": "name_en",
"message": "Name is required"
}
}| Field | Type | Description |
|---|---|---|
code | integer | HTTP status code |
error | string | Human-readable error message |
details | string/object | Additional context about the error |
Rate Limiting
API requests are rate-limited per organization. When you exceed the limit, the API returns 429 Too Many Requests with a Retry-After header indicating how long to wait.
Standard limits:
| Scope | Limit |
|---|---|
| Read endpoints | 300 requests/min |
| Write endpoints | 100 requests/min |
| Bulk operations | 100 requests/min |
Common Patterns
Iterate All Pages
async function fetchAll(endpoint, token) {
const results = [];
let page = 1;
let hasNext = true;
while (hasNext) {
const response = await fetch(
`https://linkit.works/api/v1/${endpoint}?page=${page}&limit=100`,
{ headers: { 'Authorization': `Bearer ${token}` } }
);
const data = await response.json();
results.push(...data.data);
hasNext = data.has_next;
page++;
}
return results;
}