Quickstart

Your first call takes two headers and one JSON body.

1. Get credentials

Credentials are issued per organization, on request, together with test stores. You receive:

• an API key — send it as x-api-key;
• an organization id — send it as x-organization-id.

Both are required on every request. Neither is sufficient alone.

2. Call an operation

Every operation is a POST to a fixed path with a JSON body. Start with a directory read, because every other operation is addressed by an id one of them returns:

POST /management/stores/fetchLocations HTTP/1.1
Host: api.onetablet.com
Content-Type: application/json
x-api-key: <your-api-key>
x-organization-id: <your-organization-id>

{ "page": { "limit": 50 } }

3. Join on ids, then read orders

fetchLocations, fetchBrands and fetchStores are the identity map. Every store carries its location.id and brand.id, so you resolve your own records against ours once and key everything after that on ids — never on display names, which change.

With a locationId in hand, fetchOrders reads the order feed for a time window.

4. Page to the end

A reply carries nextCursor when more rows exist. Pass it back as page.cursor and repeat until nextCursor is absent. See Concepts → Pagination.

Where to go next

• Authentication — what the two headers mean and how they fail.
• Errors and retries — which status codes are worth retrying, and which are a bug in the call.