TradeOS API

A read-only REST API over your own data. Point a spreadsheet, a dashboard, or an AI assistant at it. Your data is yours; this is how you get it out.

Getting a key

Settings → API keys, as an owner or manager. The key is shown once and never again — we store only a hash of it, so we cannot read it back to you. Lose it and you issue a new one. Revoking a key stops it working immediately.

Authentication

curl https://tradeos.mcmanussolutions.co.uk/api/v1/inventory \
  -H "Authorization: Bearer tos_your_key_here"

The key identifies your business. There is no parameter for naming which business to read — it comes from the key alone, so a key can only ever return your own data.

Endpoints

GET /api/v1/productsProducts

Your catalogue, alphabetically.

id, sku, name, description, category, unit_price, compare_at_price, status, created_at

GET /api/v1/inventoryStock

Free to sell per product — the same figure the shop and the till use, derived from component stock rather than stored. This is the one you cannot get anywhere else.

product_id, free_units

GET /api/v1/ordersOrders

Sales orders, newest first.

id, order_number, status, payment_status, customer_id, delivery_type, promised_date, delivery_charge, discount_amount, amount_paid, dispatched_at, delivered_at, created_at

GET /api/v1/customersCustomers

Your customer book.

id, name, company_name, account_type, email, phone, credit_limit, created_at

Paging

?limit= (default 50, maximum 200) and ?offset=. Every response carries a pagination object with total and has_more.

{
  "data": [ { "product_id": "…", "free_units": 3 } ],
  "pagination": { "limit": 50, "offset": 0, "total": 128, "has_more": true }
}

Read-only, on purpose

Keys can read. They cannot write, and that is deliberate rather than unfinished. An assistant reading your data also reads text other people wrote into it — a customer's delivery note, an enquiry from your website — and text like that can contain instructions. A key that cannot write cannot be talked into cancelling an order by something a stranger typed into a form.

If you need a specific write — adding a note, updating a date — tell us which one and we will scope a key to exactly that, rather than handing over everything.

Before you connect an AI assistant

Worth saying plainly: pointing ChatGPT at this API sends your business data — including customer names and addresses — to that provider. That is your decision to make, and under UK GDPR it is your responsibility as the data controller. Make it knowingly.

Errors carry a code you can look up in the error reference. Moving data in rather than out? See the CSV import formats.