Idovio Commerce API and integration reference

What is available today

• Live

  Connection broker at connect.idovio.com: OAuth callbacks and the privacy notifications that Shopify and eBay require.

• Live

  Web application at idovio.app.

• Not public yet

  Account and workspace API: built and covered by automated tests, but not yet published at a public address. The reference below describes the version in the source code.

• Not public yet

  API keys for third-party applications are not issued yet. Scopes and limits will be documented here when they are.

Authentication

• People sign in with an Idovio account: e-mail and password, or Google. Sensitive actions require a second factor (TOTP).
• On the web the session travels in an HttpOnly cookie. Every request that changes something must send the CSRF token in the X-Idovio-CSRF header and come from an allowed origin.
• The desktop and mobile applications receive the session token once and send it as Authorization: Bearer.
• Every workspace request is checked against the membership and role of the signed-in user; data from one workspace is never returned to another.

Connection broker

Providers send the merchant back to these addresses after consent, and deliver their mandatory privacy notifications here. The broker stores nothing: it exchanges the authorization for tokens and hands them to the merchant's own workspace.

REST endpoints

All paths are relative to the API origin. Requests and responses are JSON.

Tools for external agents

An external assistant acts through the same control plane as a person. A credential identifies it, but every call still passes workspace binding, scope, policy, limits and, where required, human approval, and is recorded.

• commerce.get_overview
• catalog.search
• supplier.rank_routes
• orders.search
• ui.navigate
• supplier.reroute
• price.update
• automation.run

Integrations

For each connection: how the merchant authorizes it, what Idovio Commerce can do through it, which classes of data it handles and how changes arrive. Current availability is on the Connections page. Connections

Conventions

• Errors are JSON with a stable code and a readable message. A 429 answer carries Retry-After.
• Every answer carries X-Request-Id. Send your own value in the same header to follow a request end to end.
• Operations that change stock, prices or orders use an idempotency key, so repeating a request never repeats its effect.

Data protection

• Connection credentials are encrypted per workspace before they are stored and are never returned by the API.
• A merchant can disconnect a provider at any time; the stored authorization is removed.
• Deletion requests received from providers are acknowledged and applied to the affected workspace.

Privacy policyTermsSecurityTechnical contact: idev@idovio.com