api reference

okommerce exposes a complete REST API for every operation in the admin. the API is documented with OpenAPI 3.1 and explorable via Swagger UI at /swagger on any okommerce install.

authentication

API requests authenticate via bearer tokens. tokens carry the user's role and scope, so the API enforces the same access rules as the UI.

POST /api/v1/auth/login
{
  "email": "user@example.com",
  "password": "..."
}

resource endpoints

every entity has a standard CRUD interface — /api/v1/products, /api/v1/orders, /api/v1/customers, etc. list endpoints support filtering, sorting, and pagination via query parameters.

webhooks

register webhooks to receive events: order.created, order.paid, customer.created, etc. webhooks are signed with HMAC for verification.