Orderwerks REST API (1.19)

Authentication

Every request must carry one of two header sets. Each endpoint lists which set it accepts under Authorizations.

API key and secret (recommended for integrations): send x-apiKey and x-apiSecret. Requests authenticated this way run as the supplier's master user. Add a vendorGuid header to act in the context of one customer, and optionally a userGuid header to attribute the call to a specific user.

User session headers (used by the Orderwerks web and mobile apps): send userGuid, userToken (the JWT issued at login) and supplierGuid, plus vendorGuid when acting for a customer.

API keys are created in the Orderwerks web app under Business Settings. The secret is shown once, at creation.

Conventions

• Paths are versioned per resource (/v1/..., /v2/...); a few legacy paths have no version segment.
• Responses are JSON. There is no common envelope; each endpoint documents its own shape.
• Paged list endpoints take limit (default 25, maximum 100) and offset. offset is a page number, not a row count: the server skips offset * limit rows.
• Delta sync: list endpoints that return serverTimestamp accept it back as lastUpdatedAt on the next call to fetch only rows changed since then. Soft-deleted rows are included in delta responses with deleted_at set.
• Errors return 4xx/5xx with a JSON body of the form { "message": "..." }. A few legacy endpoints return a plain-text message instead; those are noted individually.

Terminology

Orderwerks calls the business operating the account the supplier, and the customers who place orders vendors (also "accounts" or "customers" in the apps). Vendor endpoints are customer endpoints.