The Stockroom API lets your own code work with your purchase orders, suppliers and stock: create an order from an ERP, receive a delivery from a warehouse app, or pull cost history into a spreadsheet on a schedule. Webhooks come with it, so nothing has to sit and poll for changes.
Purchase orders and receiving stay free. The API is part of the paid advanced tier, and while it is in early access it is available on request.
Ask for access
Go to Settings, then API, and click Request access. That tells us, and we switch it on for your store by hand. Until then the page shows the date you asked and nothing else - there is no self-serve switch.
Once it is on, the same page holds your keys, your webhooks and a log of recent API activity. If you are a developer working on a client's store, the store needs its own access - there is no separate developer account, and development stores are not exempt.
Create a key
Under API keys, click Create key and give it three things:
Name - what is using it, like ERP sync or Warehouse scanner. Name one key per integration so you can revoke one without breaking the others.
Scopes - what it is allowed to change. Every key can read. Tick only the write scopes that integration needs: Write purchase orders, Write suppliers, Write inventory, Write manufacturing, Manage webhooks.
Expires - Never, In 90 days or In 1 year.
Stockroom shows the key once, under Copy your key now. Copy it into your own system before you close that box. It is never shown again, because Stockroom does not keep a readable copy - if it goes missing, revoke the key and create another.
The key list shows each key's scopes, when it was last used, when it expires and whether it is Active, Expired or Revoked. Revoke stops it on the very next request and cannot be undone; the row stays so you can still see what it was and when it last ran. A store can have 20 active keys at once.
Send webhooks instead of polling
Under Webhooks, Add webhook takes an https URL, an optional description, and the events you want - or All events. Stockroom then sends a signed POST to that URL when a purchase order is placed or received, a supplier changes, a stock adjustment is applied, or an item goes low or out of stock.
The signing secret is shown once when you add the endpoint, the same way a key is. Use it to check every delivery really came from us.
Send test posts a test event so you can prove the endpoint works before you rely on it. Deliveries opens the log of what was sent, what your server answered and how long it took, with Redeliver on any row. A delivery that fails is retried after a minute, five minutes, half an hour, two hours, twelve hours and then once a day; after three days of failures the endpoint switches itself off and we email the store owner. It stays in the list, and Resume turns it back on.
See what your integration is doing
Recent activity lists the most recent requests your keys made, newest first: which key, what it called, the result and how long it took. It is the quickest way to answer "is my script actually talking to Stockroom?" - and to spot a key that is being refused.
Where the technical documentation is
Everything a developer needs - the endpoints, the request and response shapes, authentication, paging, webhook signature samples and a field-by-field mapping for anyone moving custom Stocky code across - lives at developer.stockroom.app. The API documentation link in Settings goes straight there.
Good to know
Anything the API changes is written down as the API. A purchase order's history says via API with the key's name, so you can tell your script's receive from a person's.
Products and stock levels are not in the API. Those live in Shopify, so a developer reads and writes them through Shopify's own API and gives Stockroom the Shopify ids. Stockroom never changes product data.
Stock changes are not instant in Shopify. A receive is recorded straight away and then pushed to Shopify through a queue, so the response tells you the push is pending rather than pretending it has landed.
Not everything is in the API yet. Purchase orders end to end, suppliers and stock adjustments are there. Stocktakes, transfers, builds, lot numbers, attachments, comments, reorder suggestions and reports are not, and neither is the cost-and-price side of receiving - an API receive books the costs you send it and never changes a selling price in Shopify.
Limits. 20 active keys and 10 webhook endpoints per store. 300 requests a minute for the store, 120 for any one key, and 60 a minute for requests that change something.