Enterprise API: Orders, Bookings & Webhooks

Who this is for

Enterprise organisations with API access can create keys in Settings → Website integration → API Keys. Widgets and share links remain the fastest path for most sites; the API is for headless storefronts, ERP sync, and phone/walk-in automation. Plan context: Pricing.

Authentication

Send Authorization: Bearer ordafy_live_… or ordafy_test_… on every request. Use an Idempotency-Key header on POST creates for safe retries.

OpenAPI reference: apps/api/docs/public-v1.openapi.yaml (merchant namespace).

Provider orders

• POST /api/public/v1/merchant/orders — line items with productVariantId, customer email or id, pickup/delivery
• GET /api/public/v1/merchant/orders — paginated list
• PATCH /api/public/v1/merchant/orders/{orderId} — status transitions (confirm, cancel, processing, delivered)

Customers receive the same confirmation email as dashboard-created orders when an email is provided.

Provider bookings

• POST /api/public/v1/merchant/bookings — scheduledDate, optional scheduledTime (validated against availability)
• PATCH /api/public/v1/merchant/bookings/{bookingId} — confirm, cancel, complete, or reschedule

Day-to-day staff still use Business Bookings (/services/bookings) and Calendar (/calendar) alongside API-created appointments.

Webhooks

Register endpoints under Website integration → Webhooks. Events include order.created, order.updated, booking.created, booking.updated, and payment.completed. Verify Ordafy-Signature (HMAC-SHA256) before you trust payloads.

Headless loop

1. Create catalogue via POST /merchant/products or /merchant/services (or manage in Business UI).
2. Customers book via widget or hosted links—or you create orders/bookings entirely via API for phone and walk-in sales.
3. Receive webhooks in your ERP or CRM.
4. Staff fulfil from Business Orders / Bookings as usual.

Frequently asked questions

Do I need the API to embed a widget?

No. Widgets only need a share/embed snippet from Business—see share links & embed codes.

Live vs test keys?

Use test keys in staging. Switch to live keys only after payouts and catalogue are production-ready.

How do widgets and API work together?

Widgets collect customer-facing checkout; the API creates or syncs records for systems your customers never see.

Related reading

Widgets overview · embedding guide · Become a provider · Pricing.