API & Webhook Documentation

Overview

The Public API uses REST with JSON payloads over HTTPS. All endpoints are idempotent — re-sending the same record updates nothing and returns the existing entity.

https://<your-app-domain>/api/public/v1

Authentication

Generate an API key inside Settings → API Keys. Pass it on every request via theX-API-KEY header.

X-API-KEY: sk_live_your_secret_api_key_here
Content-Type: application/json

Keys are scoped to a single organisation. Revoked or invalid keys return 401 Unauthorized. Frozen organisations return 403 Forbidden.

Upload Products via REST API

{
  "name": "Steel Rod 12mm",         // required, max 255 chars
  "description": "Construction-grade rebar",  // optional
  "price": 450.00                    // optional, defaults to 0
}

{
  "id": "9c7a...",
  "sku": "PRD-00042",
  "name": "Steel Rod 12mm",
  "created": true
}

curl -X POST https://<your-app-domain>/api/public/v1/products \
  -H "X-API-KEY: sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"name":"Steel Rod 12mm","price":450}'

Upload Parties (Customers & Vendors)

{
  "name": "Acme Distributors Pvt Ltd",   // required, max 255 chars
  "contact_info": "Ravi Kumar | +91 98765 43210 | ravi@acme.in"  // optional
}

{
  "id": "4f1b...",
  "name": "Acme Distributors Pvt Ltd",
  "created": true
}

curl -X POST https://<your-app-domain>/api/public/v1/parties \
  -H "X-API-KEY: sk_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{"name":"Acme Distributors","contact_info":"+91 98765 43210"}'

HTTP Error Codes

Webhook & Push Integration Guide

To push data from your third-party app whenever a product or party is created/updated, configure an outbound webhook on your side that calls the endpoints above. Recommended pattern:

1. Generate an API key from Settings → API Keys and store it as a secret in your application.
2. On every product.created / product.updated event in your ERP, fire a POST to /api/public/v1/products.
3. On every party.created / customer.updated event, fire a POST to /api/public/v1/parties.
4. Treat HTTP 2xx as success. On 5xx, retry with exponential backoff (1s, 5s, 30s, 5m).
5. Endpoints are idempotent by name — safe to re-send the same payload.

const items = await myErp.getProducts();
for (const p of items) {
  await fetch("https://<your-app-domain>/api/public/v1/products", {
    method: "POST",
    headers: {
      "X-API-KEY": process.env.LOVABLE_API_KEY,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({
      name: p.title,
      description: p.notes,
      price: p.unit_price,
    }),
  });
}