Skip to content
Channels & delivery

Partner API & webhooks

Per-store keys, a fixed ability catalogue, and a secret shown exactly once

Wameed’s API was complete but private: tokens for its own apps, no documentation, no partner credentials. Eight of ten competitors expose a public API. This ships the programme end to end.

From the Enterprise plan up

What this covers

  • Per-store API keys with a fixed ability catalogue: catalogue read, orders read and write, inventory read, reports read, webhook management and customers read
  • The public identifier is listable; the bearer secret is shown once and stored only as a hash
  • Rotation — the same identity with a new secret; and soft revocation — traffic stops, history survives
  • A deliberately thin, stable partner namespace with its own controllers, wrapping the existing services rather than re-exposing internal ones — so refactoring the till cannot silently break an integrator
  • Order write-back lands in the real order pipeline, with storefront pricing rules: prices come from the catalogue, never from the request
  • Outbound webhooks per store, subscribing to order.created, order.status_changed, stock.low and invoice.reported
  • Every webhook carries an HMAC-SHA256 signature, with exponential retry, automatic disabling after 20 consecutive failures, and a full delivery ledger
  • A hand-authored OpenAPI 3.0 document and an HTML reference rendered from that same file — with a parity test pinning the spec to the router in both directions
  • Usage metering — per-key daily counters, surfaced to the owner and charted in the app

Related features

All features
  • Plan: Enterprise

    App marketplace

    Installing is minting a key — there is no second permission system

    6 capabilitiesSee the detail

  • Plan: Professional

    Delivery platform integrations

    Ten Saudi platforms, one order queue — and no second tablet on the counter

    12 capabilitiesSee the detail

  • Security & data protection

    Card data is never stored, backups are encrypted, and every security event is logged

    10 capabilitiesSee the detail

See it on your shop

Thirty minutes on your products, your tax setup and your hardware — not a slide deck.