Requests and responses

The address, headers and data formats shared by every endpoint.

Overview

All endpoints use JSON over HTTPS and follow the same rules for headers, dates, money and IDs.

Address

Base URL

https://api.o2m.in/api/v1

Every request goes to this address over HTTPS. Paths such as /stock are added after it, so GET /stock means https://api.o2m.in/api/v1/stock.

Requests must come from your server. A page in a web browser cannot call the API: it would expose your secret key, and O2M refuses such a request with 403 and the message "This request came from a site that may not use the O2M API."

Headers

Headers you send

Header	When	Value
`X-Access-Key`	Every request	Your access key.
`X-Secret-Key`	Every request	Your secret key.
`Content-Type`	With a body	`application/json`
`Idempotency-Key`	Optional, on creating requests	Makes a retry safe. See Idempotency.
`X-Request-Id`	Optional	Your own reference for the request: 8 to 128 letters, digits or `.`, `_`, `:`, `-`. O2M makes one if you do not.

Headers you get back

Header	Meaning
`X-Request-Id`	The request's reference. Quote it when you contact support.
`X-RateLimit-Limit`	How many requests this key may make in a minute.
`X-RateLimit-Remaining`	How many it has left now.
`Retry-After`	With a `429`: the seconds to wait.
`Idempotent-Replay`	`true` when the answer is a saved copy of an earlier one.

Data formats

Kind	Format	Example
Requests and responses	JSON, up to 100 KB per request	See any endpoint
IDs	Text, even when they look like numbers	`"4410"`
Date and time	ISO 8601. Responses are in UTC	`2026-10-02T10:00:00Z`
Date	`YYYY-MM-DD`	`2027-10-01`
Money	A number in rupees	`30.51`
Empty value	`null`	`"courier": null`

SKUs are matched without regard to upper or lower case.
In a path, encode any special characters in a SKU, for example /stock/MUG%2FBLUE.
A filter value O2M does not recognise gives an empty list, not an error.

Versioning

This is version 1 of the API, and the version is part of the base URL. Within a version, fields are added but never renamed or removed. Write your code to ignore fields it does not know.