API Overview
StockrHub’s /api routes support its own embedded Shopify admin interface. This reference helps explain app behavior and troubleshoot requests. StockrHub does not currently offer a public integration API, developer API keys, or a versioned contract for external automation. Contact us if you need an integration.
Requests and responses
Section titled “Requests and responses”The app sends requests to its own origin, under /api. Requests use a Shopify App Bridge bearer token. Store ownership comes from the verified token, not a shop parameter. See Authentication.
Most routes use JSON, but document downloads, CSV exports, and image routes return other content types. Responses are resource-specific; there is no universal success / data envelope. For example, an empty supplier list is:
{ "suppliers": [], "total": 0, "limit": 50, "offset": 0, "letter": null}A rejected request can return:
{ "error": "Missing or invalid Authorization header"}Check the HTTP status and the documented resource fields. For JSON writes, use Content-Type: application/json. Upload routes use their own payload formats. The endpoint reference lists common routes and their actual methods.
Request limits
Section titled “Request limits”StockrHub applies request limits per authenticated store. Standard API routes share a 60-request-per-minute bucket. Heavy routes share a separate 5-request-per-minute bucket, including inventory sync, order ingestion, reorder analysis, bulk and automatic reorder-rule updates, dropship PO creation, webhook registration, and Shopify vendor import.
Responses include X-RateLimit-Limit and X-RateLimit-Remaining. A limit rejection returns HTTP 429 with Retry-After in seconds. These are StockrHub’s current operating limits, not an availability guarantee.
Calls to Shopify and suppliers also have upstream limits. Matching supplier credentials entered separately in multiple stores share background quota coordination. Each store retains its own credentials and records. Supplier work may wait or be deferred; a queued response is not confirmation that the supplier accepted an order.
Errors and safe recovery
Section titled “Errors and safe recovery”| Status | What to check |
|---|---|
400 |
Required fields, payload shape, or operation validation. |
401 |
Missing, expired, or invalid Shopify session token; reopen the app if authentication does not recover. |
403 |
Installation or setup restrictions, or an operation the store cannot currently perform. |
404 |
The resource is unavailable in the authenticated store. |
409 |
A conflicting state, revision, or operation requires reloading and review. |
429 |
Respect the response’s Retry-After delay. |
500 / 503 |
An unexpected failure or temporary dependency/setup problem; inspect the existing operation before trying again. |
New installations start in setup mode. Configuration and initialization are available, while external actions and operational changes remain restricted until the installation is reviewed.
Retry a read after an appropriate delay. For order submission, payment capture, email, fulfillment, or inventory changes, first check whether the operation already completed. A timeout does not prove that an external service rejected the action. Use the app’s existing status, activity, and recovery controls rather than replaying a mutation blindly.