Credentials stay in this page’s memory until you clear them or leave. They are sent directly to the production API only when you run a request; they are never saved or inserted into the static examples.
Requests go directly to https://api.tecapy.com/v1/api. The API must allow this documentation site’s origin and request headers in CORS.
Start here
Two credentials. One store.
Sign in to the CRM and select your store.
Open Settings → More settings → APIs & MCPs.
Generate a key and save it immediately. It is displayed only once.
Copy the project ID from the same page. Send both headers with every request.
Keep keys on your server or in a secret manager. Do not hardcode them in browser JavaScript or place them in public code, URLs, analytics, or logs. Do not send your user ID with REST requests; it is used only by the authenticated CRM when generating a key.
Each key is bound to its project. A mismatched project ID is rejected. Generating a replacement invalidates the old key; deleting it revokes access. The CRM shows active status, never a previously generated key.
A predictable contract.
JSON over HTTPS
Send Content-Type: application/json for bodies. Successful responses contain success, message, and data; errors contain success:false, a top-level message, and error.code / error.details. IDs are opaque strings. Percent-encode path parameters; never concatenate untrusted values directly into a URL.
Partial updates
PATCH changes supplied fields only. Unknown fields are rejected. Read-only fields cannot be set, and write-only secrets are never returned.
Currency & dates
Monetary numbers are major units: 5000 means UGX 5,000. Use ISO currency/country codes. Wallet and ad settings use USD. Dates use ISO 8601 UTC; ranges are [from, to).
Pagination
Paginated collection endpoints accept limit and cursor. Use the cursor returned by the server; do not interpret it. Other arrays are complete, bounded provider reports unless noted. Default collection order is createdAt DESC, id DESC; filters and cursor stay consistent across pages.
Payments and asynchronous work
Use the Payments endpoints to create wallet, license or integration payment links. Product imports, feed refreshes and domain setup return the resource or job in a pending state; payment redirects and pending records are not proof of payment. Poll the corresponding GET endpoint for verified state. Never retry a charge blindly.
Permissions and limits
The backend must validate store access, licenses, trial eligibility, input and provider requirements for every operation. Platform admin, account signup/login, invitation acceptance, and API-key management remain authenticated CRM flows. If limited, honor Retry-After on 429; use exponential backoff for temporary 5xx errors. No fixed rate quota is promised by this draft.
No matching endpoints. Try another word or clear the search.
Endpoint reference
Store & settings
Read and update the store bound to your key. Store creation and deletion are available only in the CRM.
GET/v1/api/storeGet store+
Get store
Return the complete store data, including workingHours. Timestamps are serialized as ISO 8601 UTC strings.
Send only editable fields. Do not include id, slug, status, createdAt, updatedAt; these read-only fields are rejected. workingHours is an array of Mon-Fri, Sat and Sun groups with day, isOpen, open and close. A successful update returns the same full Store shape as GET.
Request fields
Field
Type
Meaning
name
string
Business name.
description
string
What the business does.
country
string
Country name.
countryCode
string
ISO 3166-1 alpha-2 country code.
currency
string
Store base currency.
phoneNumber
string
International phone number including country code.
contactEmail
string
Business contact email.
address
string
Street address.
city
string
City.
state
string
State or region.
zipCode
string
Postal code.
googleMaps
string
Google Maps embed URL for the store location.
workingHours
array<object>
Three groups, each once: Mon-Fri, Sat, Sun. Each entry has day, isOpen, open and close. Times are local HH:mm. isOpen:false means closed. PATCH replaces the entire array.
Maintain your inventory. Prices are in the product currency. A category and a cover image are required. image is the cover URL; images contains additional URL strings.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Send editable fields only. image is the cover URL and images is an array of additional URL strings. Do not send id, projectId, slug, createdAt or updatedAt. The backend validates image URLs and queues feed updates.
Request fields
Field
Type
Meaning
nameRequired
string
Product title, natural capitalization, maximum 100 characters.
brandRequired
string
Brand or Unbranded.
categoryRequired
string
Category display name.
categoryIdRequired
string
Opaque resource ID.
descriptionRequired
string
Plain-text description.
priceRequired
number
Regular price in the product currency.
discountPrice
number / null
Optional sale price, greater than zero and lower than price; null removes the discount.
currencyRequired
string
ISO 4217 currency code.
conditionRequired
string
Product condition.new · used · refurbished
inStockRequired
boolean
Whether the product is available.
imageRequired
string
Cover image: one public HTTPS URL.
images
array<string>
Additional image URLs, as strings, not objects. The cover image is separate in image; maximum six images including the cover.
Patch editable fields only. Do not send updatedAt, createdAt, projectId, slug or id. Keep one cover URL in image and additional URL strings in images. Send discountPrice:null to remove a sale price.
Request fields
Field
Type
Meaning
name
string
Product title, natural capitalization, maximum 100 characters.
brand
string
Brand or Unbranded.
category
string
Category display name.
categoryId
string
Opaque resource ID.
description
string
Plain-text description.
price
number
Regular price in the product currency.
discountPrice
number / null
Optional sale price, greater than zero and lower than price; null removes the discount.
currency
string
ISO 4217 currency code.
condition
string
Product condition.new · used · refurbished
inStock
boolean
Whether the product is available.
image
string
Cover image: one public HTTPS URL.
images
array<string>
Additional image URLs, as strings, not objects. The cover image is separate in image; maximum six images including the cover.
Organize products and choose a replacement category before deleting a category in use.
GET/v1/api/categoriesList categories+
List categories
Cursor-paginated categories. sort accepts newest, oldest, name-asc or name-desc; defaults to newest.
Query parameters:sort.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Read checkout orders, WhatsApp enquiries and calls. Calls/WhatsApp can contain only id, createdAt, currency, productName, total and type. Checkout orders include flat customer/address fields and item snapshots. Update an order’s fulfillment status or delete a record. Order creation remains in the storefront or CRM.
GET/v1/api/ordersList orders & enquiries+
List orders & enquiries
Optional filters: type=order, type=whatsapp or type=call; from is an inclusive ISO 8601 timestamp and to is exclusive. Omit type to include all three record types. Pagination works with these filters.
Query parameters:type, from, to.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Use these two endpoints for design, branding, media, checkout preferences and store policies. Policies and checkout are nested in the design record, not separate API resources.
GET/v1/api/designGet store design+
Get store design
Read the store design with asset objects, checkout, policies, theme, social links and product presentation. Asset entries use id, path, type and url. All design fields are optional and allow null. fit/imageFit accepts cover or contain; productMedia accepts grid or slideshow; hero.mode accepts single, none or slideshow. feedAccess, tagManager, googleSiteVerification, updatedAt and asset path fields are read-only. Timestamps are ISO 8601 strings.
Patch the design fields you want to change. Include checkout preferences under checkout and pages under policies.<page>. Media fields use asset objects; toolbarLogo/footerLogo and video slots may be null. No design field is required; null is allowed. Do not send server-controlled feedAccess, tagManager, googleSiteVerification, updatedAt, schemaVersion or path inside media objects. The request example includes every editable field; the response returns the full design, including read-only fields.
Request fields
Field
Type
Meaning
checkout
object / null
See the OpenAPI schema for nested properties.
designComplete
boolean / null
Whether a design has been saved.
logo
object / null / null
Media asset object, or null to clear it.
toolbarLogo
object / null / null
Media asset object, or null to clear it.
footerLogo
object / null / null
Media asset object, or null to clear it.
logoVisibility
object / null
See the OpenAPI schema for nested properties.
hero
object / null
See the OpenAPI schema for nested properties.
paymentIcons
array / null
See the OpenAPI schema for nested properties.
policies
object / null
Store pages keyed by about, faq, payments, privacy, returns, shipping or terms. Save body and published under the page key.
productCard
object / null
See the OpenAPI schema for nested properties.
productMedia
string / null
Product details layout.grid · slideshow ·
socialLinks
object / null
Social platform names mapped to public profile URLs.
theme
object / null
See the OpenAPI schema for nested properties.
crawlersEnabled
boolean / null
Allow search engines to crawl the dedicated store domain.
Set provider credentials. PayPal uses client_id and client_secret; provider must be flutterwave, paystack, pesapal, stripe, dpo or paypal. Stripe uses publishable_key/secret_key; DPO uses company_token/service_type; Flutterwave/Paystack use public_key/secret_key; Pesapal uses consumer_key/consumer_secret.
Connect existing domains, search and purchase new ones, inspect registration details, renew and manage DNS. Payment confirmation is verified server-side.
GET/v1/api/domainsList connected domains+
List connected domains
Read connected hostnames.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Read purchased domain registration and owner details. ACT means active; PEN means pending because payment has not been completed. expirationDate is Unix seconds; addressNumber is an integer. authCode is confidential.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Register and purchase a domain using flat owner contact fields and domainName. state is required. Do not send status, expirationDate, domainId, contactHandle or authCode. No quoteId is needed. Follow paymentLink to complete payment.
GET/v1/api/custom-domains/{hostname}/dnsList DNS records+
List DNS records
Read DNS records.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Independent integrations use OAuth consent. Managed Google campaigns share the same wallet and setup checks as the CRM. Advertising-platform credentials never appear in responses.
GET/v1/api/advertising/integrationsGet ad connections+
Get ad connections
Connection status for google, meta, tiktok, x, reddit, pinterest, snapchat, bing and google_tag. mode is managed or independent. Google Tag Manager uses google_tag under Independent integrations.
Return a short-lived authorization URL. The account holder completes consent in the browser. Use platform google_tag for Google Tag Manager, like other Independent integrations.
Request fields
Field
Type
Meaning
returnUrlRequired
string
Required. See the downloadable contract and request example.
Read catalog feed URLs and access credentials for supported platforms. Treat these credentials as confidential. Feed format and availability/condition casing depend on platform.
Google only. Validate license, store merchant details and verified wallet funds. Merchant details are resolved from this store, not trusted from another project.
Request fields
Field
Type
Meaning
platformRequired
string
Managed provider.google
statusRequired
string
Requested campaign state.active · inactive
budgetRequired
number
Average daily budget in USD.
maxCpcRequired
number
Maximum USD cost per click.
countryCodeRequired
string
Target country code.
countryRequired
string
Target country name.
scheduleRequired
object
All seven day names required; start must precede end.
timeZone
string
IANA timezone. Accepted only when creating a campaign; cannot be updated. Omit if unknown.
Create payment links to recharge your advertising wallet, pay the one-time USD 300 storefront license, or subscribe to an Independent integration or APIs & MCP (platform api) for USD 60 per month. currency is required for each request. Returned amount is in that currency; amountUsd is the USD charge. Follow paymentLink to pay; creating a link does not confirm payment.
POST/v1/api/payments/depositRecharge wallet+
Recharge wallet
Send currency for local payment and amount in USD. Only deposits accept an amount; the backend converts it into the requested local currency.
Request fields
Field
Type
Meaning
currencyRequired
string
Local currency for the payment link, for example UGX.
Send currency only and choose the integration platform in the URL: google, meta, tiktok, x, reddit, pinterest, snapchat, bing or api (APIs & MCP). The price is fixed at USD 60 per month; do not send amount or amountUsd. The response type is the platform, and renewsOn is returned only for subscriptions.
Request fields
Field
Type
Meaning
currencyRequired
string
Local currency for the payment link, for example UGX.
Read balances and entitlements. Use Payments to create wallet, license or integration payment links. Clients cannot set balances, licenses or transaction payment states.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Sensitive operations require the appropriate store-owner authorization. API access never grants platform-team or cross-store access.
POST/v1/api/transfersInvite store manager or owner+
Invite store manager or owner
Creates an invitation. Full transfer removes the original owner after acceptance; partial adds shared management. Acceptance requires the recipient to sign in to Tecapy.
Request fields
Field
Type
Meaning
emailRequired
string
Recipient email.
transferRequired
string
Full removes the original owner’s access after acceptance; partial adds shared management.full · partial
Return deviceId, token, updatedAt and userId for registered devices. Treat push tokens as confidential.
Pagination: limit (1–100, default 20), cursor (opaque). For the first page, omit cursor. For the next page, replace your_next_cursor in the example with meta.nextCursor, keeping the same filters and sort. Stop when meta.hasMore is false.
Send deviceId and token only. deviceId must match the URL. Do not send updatedAt or userId; they are assigned by the server. Browser must first grant notification permission; registration alone cannot grant it.
Request fields
Field
Type
Meaning
deviceIdRequired
string
Device identifier. Must match deviceId in the request URL.
Required fields apply to creation or replacement. PATCH accepts a subset, but the resulting resource must remain valid. The OpenAPI file includes nested schemas and all operation-specific fields.
Product
Field
Type
Meaning
id
stringRead only
Opaque resource ID.
projectId
stringRead only
Store project ID, resolved from X-Project-ID.
slug
stringRead only
Server-generated product slug.
nameRequired
string
Product title, natural capitalization, maximum 100 characters.
brandRequired
string
Brand or Unbranded.
categoryRequired
string
Category display name.
categoryIdRequired
string
Opaque resource ID.
descriptionRequired
string
Plain-text description.
priceRequired
number
Regular price in the product currency.
discountPrice
number / null
Optional sale price, greater than zero and lower than price; null removes the discount.
currencyRequired
string
ISO 4217 currency code.
conditionRequired
string
Product condition.new · used · refurbished
inStockRequired
boolean
Whether the product is available.
imageRequired
string
Cover image: one public HTTPS URL.
images
array<string>
Additional image URLs, as strings, not objects. The cover image is separate in image; maximum six images including the cover.
facebookVideo
string / null
Facebook video URL, or null.
tiktokVideo
string / null
TikTok video URL, or null.
youtubeVideo
string / null
YouTube video URL, or null.
createdAt
stringRead only
Server-generated UTC timestamp.
updatedAt
stringRead only
Server-generated UTC timestamp.
Category
Field
Type
Meaning
id
stringRead only
Opaque resource ID.
nameRequired
string
Category name.
slug
stringRead only
Server-generated category slug.
createdAt
stringRead only
Server-generated UTC timestamp.
UpdatedAt
stringRead only
Server-generated UTC timestamp.
Store
Field
Type
Meaning
id
stringRead only
Opaque resource ID.
name
string
Business name.
slug
stringRead only
Storefront slug. Cannot be changed through the API.
description
string
What the business does.
country
string
Country name.
countryCode
string
ISO 3166-1 alpha-2 country code.
currency
string
Store base currency.
phoneNumber
string
International phone number including country code.
contactEmail
string
Business contact email.
address
string
Street address.
city
string
City.
state
string
State or region.
zipCode
string
Postal code.
googleMaps
string
Google Maps embed URL for the store location.
workingHours
array<object>
Three groups, each once: Mon-Fri, Sat, Sun. Each entry has day, isOpen, open and close. Times are local HH:mm. isOpen:false means closed. PATCH replaces the entire array.
status
stringRead only
Platform-controlled publication status.
createdAt
stringRead only
Server-generated UTC timestamp.
updatedAt
stringRead only
Server-generated UTC timestamp.
Order
Field
Type
Meaning
idRequired
stringRead only
Opaque resource ID.
createdAtRequired
stringRead only
Server-generated UTC timestamp.
typeRequired
string
Record type.order · whatsapp · call
currencyRequired
string
Record currency.
productNameRequired
string
Product name, or Store enquiry for a general call/WhatsApp record.
totalRequired
number
Recorded total; general store enquiries may have zero value.
customerName
string
Checkout customer name; absent on basic enquiry records.
Check Authorization or generate a replacement in the CRM.
403
Access denied
Check the project ID, store permissions and required license.
404
Not found
Check the ID; cross-store resources are never disclosed.
409
Conflict
Check duplicate resources or the current resource state.
422
Validation failed
Read error.details and correct the request.
429
Rate limited
Wait for Retry-After before retrying.
500 / 503
Temporary service failure
Retry with backoff after checking whether the previous request completed.
Every success uses {success:true,message:"Success",data:...}. Every error uses {success:false,message:...,error:{code:...,details:...}}. Error codes are machine-readable strings such as NOT_FOUND; details explains the failure. If a server supplies an X-Request-ID, share it with support, never your key. Documentation values in angle brackets are placeholders, not real credentials or user data.
Ready to connect your store?
Generate your credentials, save them securely, and build against this versioned contract.