Catalog
REST access to items, categories and stock levels. Pagination, filters, ETag.
SECONDARY INDUSTRIAL SUPPLY
API for partners
OAuth2 (client_credentials), REST resources for the catalog and orders, signed webhooks and a TypeScript SDK.
Four integration surfaces
Orders
Create, cancel and track deals. Escrow statuses and closing documents.
Webhooks
HMAC signatures, retries with backoff, and events for logistics, financing and settlements.
TypeScript SDK
The SDK is in preparation. Start with the live OpenAPI spec and the Postman collection — quickstart below.
Your first request in a minute
GET/api/partner/v1/catalog/search
partner / v1 / catalog / search
$ curl -H "Authorization: Bearer ${TOKEN}" \
"https://api.restok.pro/api/partner/v1/catalog/search?q=задвижка"
{
"success": true,
"data": [
{ "id": "SKU-10234", "title": "Задвижка стальная 30с41нж DN100", "region": "RU-MSK" },
{ "id": "SKU-10891", "title": "Задвижка чугунная 30ч6бр DN80", "region": "RU-SPE" }
],
"meta": { "page": 1, "total": 248 }
}Signed events
The platform delivers events (logistics, financing, settlements) as a POST request to your HTTPS endpoint. Every delivery is signed with HMAC-SHA256: the X-Restok-Signature header = sha256=HMAC(secret, `${timestamp}.${body}`), where timestamp comes from X-Restok-Timestamp. A 2xx response means delivered; otherwise we retry up to 5 times with exponential backoff (5s → 40s), then dead-letter it. The signing secret is issued once, when you create the subscription.
HMACsignature verification on your side (Node.js)
verify-webhook.mjs
import crypto from 'node:crypto';
// Заголовки доставки: X-Restok-Signature ("sha256=<hex>"),
// X-Restok-Timestamp (unix-секунды), X-Restok-Event, X-Restok-Delivery.
function verifyRestokWebhook(headers, rawBody, secret) {
const ts = headers['x-restok-timestamp'];
const expected = 'sha256=' + crypto
.createHmac('sha256', secret) // secret — whsec_… из ответа на создание подписки
.update(`${ts}.${rawBody}`) // timestamp связан подписью (анти-replay)
.digest('hex');
const given = Buffer.from(headers['x-restok-signature'] ?? '');
return given.length === Buffer.byteLength(expected)
&& crypto.timingSafeEqual(given, Buffer.from(expected))
&& Math.abs(Date.now() / 1000 - Number(ts)) < 300; // окно 5 минут
}A predictable contract
1C and EDI — honest status
Documentation and tools
§05 — ACCESS
Request an API key
Give us your email and company — we'll get in touch and send your client_id, client_secret and a link to the sandbox.
- ✓ OAuth2
- ✓ Sandbox free
- ✓ SLA 99.9%