Build on Vendu.

Integrate orders, products, and conversations into your stack. REST API with cursor pagination, sparse fieldsets, ETag caching, and RFC 7807 error details.

Quickstart

Three steps to your first API call.

1. 1

   Generate an API key

   Go to Dashboard → Settings → Developers and click Generate new key. Copy the vk_live_… token — it is shown only once.

2. 2

   Make your first request

   Use any HTTP client. The example below lists your most recent orders.

3. 3

   Handle the response

   All list responses follow the ListEnvelope shape with data[], has_more, and next_cursor for pagination.

curl https://api.vendu.app/api/v1/orders \
  -H "Authorization: Bearer vk_live_YOUR_KEY" \
  -H "Accept: application/json"

Authentication

Every request must include a Bearer token in the Authorization header.

Webhooks

Vendu posts JSON events to your registered URL when things happen in your tenant. All payloads share the same envelope shape.

Verifying the signature

Every request carries an X-Vendu-Signature header — HMAC-SHA256 of the raw body with your endpoint secret.

import { createHmac, timingSafeEqual } from 'crypto';

function verifyVenduWebhook(
  rawBody: string,
  signature: string,
  secret: string,
): boolean {
  const expected = createHmac('sha256', secret)
    .update(rawBody)
    .digest('hex');
  const a = Buffer.from(signature);
  const b = Buffer.from(expected);
  return a.length === b.length && timingSafeEqual(a, b);
}

Register endpoints at Dashboard → Settings → Webhooks.

Rate Limits

Sliding-log per API key over a 60-second window. Two independent buckets: Read (GET / HEAD) and Write (POST / PUT / PATCH / DELETE).

Error Catalog

All errors follow RFC 7807 Problem Details with Content-Type: application/problem+json. Switch on the stable type URI slug.

Pagination

All list endpoints use cursor-based pagination. Pass ?cursor= + ?limit= (default 50, max 100). The response includes next_cursor when has_more is true.