API overview

This section is for developers

Everything else in this manual is for the people who use ConsignTrak's screens. This section is for whoever connects ConsignTrak to other software: an in-house developer, an IT contractor, or someone building workflows in a tool such as n8n. If that isn't you, you can skip it.

What the API is

ConsignTrak has a JSON API over HTTPS. It lives at /api/v1/ on the same address you sign in to, for example https://your-site.consigntrak.com/api/v1/items.

The rule behind it is simple: anything you can do on the screens, a program can do through the API. The screens are one client among many. The same capabilities serve integration tools, customer scripts, and other business systems such as a CRM.

The API covers:

Area	Examples
Items and inventory	Search items by part number (with fuzzy matching), read stock by bin, adjust stock, relocate
Orders	Create an order with its lines in one call, release, cancel, filter the order list, read the exception queue
Receiving	Create batches, add lines, inspect, post, void
Picking and shipping	Stage, pack and ship, add or remove boxes and tracking numbers
Customers and contacts	Create and update customers, drop-ship locations, contacts and their roles
Cycle counts and locations	Generate and record counts, manage bins
Reporting	The end-of-day shipment report
Events and webhooks	Poll a stream of events (order released, order shipped and more), or register a webhook to have them pushed to you
Administration	Users, API keys, account security

The API reference lists every endpoint with its parameters, request and response shapes, and examples.

Authentication

Every request carries an API key as a bearer token:

GET /api/v1/items?q=6205-2RS HTTP/1.1
Host: your-site.consigntrak.com
Authorization: Bearer jwc_…

curl -H "Authorization: Bearer $CONSIGNTRAK_API_KEY" \
  "https://your-site.consigntrak.com/api/v1/items?q=6205-2RS"

How keys work:

• An administrator creates them on the API keys page. See API keys & connecting other tools. Keys start with jwc_.
• The key is shown once, when it's created. Store it in a secret manager. If it's lost, create a new one and revoke the old one.
• A key acts as a user. Each key is tied to a ConsignTrak user. Anything it does is recorded in the audit trail under that user's name, exactly as if they'd done it on screen.
• A key can do less than its user, never more. The administrator ticks the permissions the key gets. The key can use only permissions that are both ticked and part of the user's role. Start from role ticks a role's usual set for you.
• Supply-partner limits carry over. A key for a user tied to one supply partner sees and changes only that supply partner's data. Asking for another supply partner's record returns "not found".
• Keys can expire and be revoked. An expiry date is optional. Revoking a key stops it at once.
• Supply Partner (portal) users can't use the API. The portal is their only way in for now.
• Only bearer keys work. A browser session cookie is not accepted on /api/v1/.

Requests and responses

• JSON in, JSON out. Send Content-Type: application/json on requests with a body.

• Errors share one shape, with a short code and a message:

  { "error": { "code": "unauthorized", "message": "API key required" } }

• Lists are paged. Pass page and per_page. The response carries a meta object with page, per_page, total_count and total_pages.

• Rate limits. Too many requests, or repeated failed keys, return status 429 with the code rate_limited. Wait and retry with a back-off.

• Names in the data. The API keeps the internal name manufacturer for what the screens call a supply partner: for example manufacturer_id and manufacturer_code. They're the same thing.

• Permissions in the reference use their internal codes, such as orders.release. Permissions by role shows which roles hold which.

Events and webhooks

Integrations usually need to know when something happens, such as an order being released or shipped. ConsignTrak offers two ways:

• Poll the events endpoint on a schedule, then acknowledge the events you've handled. This suits workflow tools such as n8n.
• Subscribe a webhook. ConsignTrak posts each matching event to your address, signed so you can check it came from ConsignTrak. Failed deliveries are retried with a back-off.

Both are described in the API reference.

The reference and the spec file

• Browse it: API reference. It's generated from ConsignTrak's OpenAPI description, so it always matches this release.
• Download it: openapi.yaml (OpenAPI 3.0). Import it into Postman, Insomnia or a code generator.

If an endpoint behaves differently from the reference, or something you can do on screen is missing from the API, tell the ConsignTrak team. Missing API coverage is treated as a bug.