Platform integration
Herkese Açık REST API ve Giden Webhook'lar
What it does
- Exposes your store's data over a versioned REST API on your own domain, with token-based authentication and scoped permissions.
- Lets you subscribe external URLs to store events such as order.paid, product.updated, and stock.low, signed with HMAC.
- Connects third-party integration platforms and your own scripts without a custom module.
Every Kambloo store has its own API surface. The public REST API lets your developers, agencies, and third-party tools read and write store data without waiting for an official module. Outgoing webhooks push events to your systems as they happen. Both are included; there is no provider to pay.
How it works with Kambloo
Authentication uses personal access tokens issued from the admin panel. Each token carries scopes such as products:read or orders:write, so a reporting script cannot change data. Tokens work on your store's own domain, for example https://your-store.com/api/v1/orders, and Kambloo resolves the store from the domain.
Resources are products, product variants, orders, customers, and stock, each with create, read, update, delete, and list operations. Lists use cursor pagination and a filter syntax for common fields. The API is documented with an OpenAPI specification. The API is versioned in the URL as /v1, and a breaking change means a new version with the old one supported for at least 12 months.
Rate limiting is 120 requests per minute per token, counted in Redis. Exceeding it returns 429 with a Retry-After header. This is the same public API that integration platforms such as Sentos, Prapazar, and Sopyo use to connect.
Outgoing webhooks complete the picture. You define a subscription with a target URL, a set of events, and a secret. Events cover the order lifecycle (created, paid, shipped, cancelled), catalog changes (product created, updated, deleted), new customers, and low stock. Each delivery is a JSON POST with an X-Kambloo-Signature header containing an HMAC of the payload, which your endpoint verifies. Non-2xx responses trigger five retries with exponential backoff; an endpoint that fails for three consecutive days is disabled automatically and you are notified. The panel shows the last 100 deliveries with request and response summaries and a resend button.
Target URLs pass through Kambloo's safe HTTP layer, which blocks private network addresses.
Requirements
- An API token with the right scopes, created in the admin panel.
- For webhooks: an HTTPS endpoint that verifies the signature and returns 2xx quickly.
- A published store domain, since tokens are bound to it.
Setup steps
The short version. The screens in your store admin follow the same order.
- Open Settings > Developers > API Tokens and create a token with the scopes you need, for example products:read.
- Call https://your-store.com/api/v1/products with the token as a bearer header.
- Add a webhook subscription: target URL, events, and a secret.
- Verify the X-Kambloo-Signature header on your side before trusting a payload.
Questions about Herkese Açık REST API ve Giden Webhook'lar
Which resources does the API cover?
Products, product variants, orders, customers, and stock, with create, read, update, and delete where the token's scopes allow it. The API is documented with an OpenAPI specification.
What are the rate limits?
120 requests per minute per token, enforced in Redis. Over the limit you receive 429 with a Retry-After header. Higher limits can be arranged with larger hosting plans.
How long is an API version supported?
Breaking changes ship as a new version in the URL, and the previous version stays available for at least 12 months.