REST API and Webhooks for TradeFlow ERP
Read and write customers, products, stock and orders from your other software, and get notified when things happen.
Does TradeFlow have an API?
Yes. TradeFlow provides a REST API for customers, suppliers, products, inventory, sales orders and purchase orders, authenticated with API keys that have read or write scope and documented with OpenAPI, including inside the app. Outbound webhooks notify other systems when sales orders are created or updated, dispatches are completed, payments are received and purchase orders are approved.
Who it is for
- Businesses connecting a website, app or other software to the ERP
- Developers and IT partners
- Businesses that want to stop re-typing data between systems
Common integration problems
- 01
Orders are re-typed from other systems
Orders from a website, app or another tool are keyed into the ERP by hand.
- 02
Other systems show stale stock
Stock shown elsewhere is updated from spreadsheets, so it is always behind.
- 03
Nobody knows when something changes
Other systems have to keep asking the ERP whether an order has moved on.
- 04
Access is all or nothing
Integrations share one login with full rights, and there is no way to limit or withdraw access.
- 05
Webhook calls cannot be trusted
The receiving system cannot tell whether a notification really came from the ERP.
- 06
Developers have no documentation
Integration work starts with guessing field names and endpoints.
How TradeFlow addresses them
01Orders are re-typed from other systems
The REST API can create and update sales orders, customers and products.
- REST API
- API endpoints
02Other systems show stale stock
The inventory endpoint lets other systems read current stock from TradeFlow.
- API endpoints
03Nobody knows when something changes
Webhooks notify your endpoint when sales orders are created or updated, dispatches are completed, payments are received and purchase orders are approved.
- Webhooks
- Webhook events
04Access is all or nothing
API keys are issued per company with read or write scope, can be revoked, and show when they were last used.
- Scoped API keys
05Webhook calls cannot be trusted
Each webhook delivery is signed with HMAC-SHA256 in an X-Webhook-Signature header, and deliveries are logged.
- Signed, logged deliveries
06Developers have no documentation
The API is documented with an OpenAPI specification, also viewable inside TradeFlow.
- REST API
Connecting a system to TradeFlow
- 1
Create a key
Issue an API key with read or write scope.
- 2
Read the docs
Use the OpenAPI documentation to see endpoints and fields.
- 3
Call the API
Send the key in the x-api-key header to read or write data.
- 4
Register a webhook
Add your endpoint URL and choose the events to receive.
- 5
Receive events
TradeFlow sends each event to your endpoint.
- 6
Verify
Check the X-Webhook-Signature header against your webhook secret.
- 7
Monitor
Review webhook delivery logs and when each key was last used.
- 8
Revoke
Revoke a key when it is no longer needed.
Read and write your ERP data
Endpoints for customers, suppliers, products, inventory, sales orders and purchase orders, documented with OpenAPI and viewable inside the app.
- REST APIRead and write ERP data over a REST API with OpenAPI documentation.
- API endpointsEndpoints for customers, suppliers, products, inventory, sales orders and purchase orders.
Access you can scope and withdraw
Keys issued per company with read or write scope, revocable at any time, showing when each was last used.
- Scoped API keysAPI keys are issued per company with read or write scope, can be revoked, and show when they were last used.
- Role-based permissionsControl who can view or change each module.
Get told when things happen
Events for sales orders created or updated, dispatches completed, payments received and purchase orders approved, signed with HMAC-SHA256 and logged.
- WebhooksSend events to other systems when records change.
- Webhook eventsEvents for sales orders created or updated, dispatches completed, payments received and purchase orders approved.
- Signed, logged deliveriesEach webhook delivery is signed with HMAC-SHA256 in an X-Webhook-Signature header and logged.
Who the TradeFlow API is suitable for
- Businesses taking orders through a website or app
- Businesses that want stock shown in other systems
- Teams connecting reporting or analytics tools
- IT partners building integrations for traders
- Businesses that need to limit and withdraw integration access
- Developers who want signed event notifications
Frequently asked questions
What can the TradeFlow API do?
It reads and writes customers, suppliers, products, inventory, sales orders and purchase orders over REST, documented with OpenAPI.
How is API access secured?
Requests use an API key in the x-api-key header. Keys are issued per company with read or write scope, can be revoked, and show when they were last used.
Which events can trigger a webhook?
Sales orders created or updated, dispatches completed, payments received and purchase orders approved.
How can I verify a webhook came from TradeFlow?
Each delivery is signed with HMAC-SHA256 using your webhook’s secret, in the X-Webhook-Signature header.
Is there API documentation?
Yes. The API is documented with an OpenAPI specification, which is also viewable inside TradeFlow.
Can I see whether webhooks were delivered?
Yes. Webhook deliveries are logged.
Talk to us about your integration
Book a demo and we will walk through the API documentation, API keys and webhook events with your team.