API

MPH WMS exposes a REST API under /api/v1/* for external integrations. Authenticate with a Bearer token issued from Settings → API keys.

Quick start

1. In the app, go to Settings → API keys and create a key. Pick the scopes the key needs (the same permissions as a team member).
2. Copy the key. You'll only see it once.
3. Call the API with Authorization: Bearer <key>:

curl -H "Authorization: Bearer mph_live_..." \
     https://your-tenant.mph-wms.com/api/v1/items

Conventions

• Authentication: Bearer API key (mph_live_...). One key = one tenant.
• Pagination: Cursor-based. Pass ?limit=50&cursor=...; response includes nextCursor. Sort order is fixed per resource so cursors stay stable across inserts.
• Dates: ISO 8601 UTC (2026-06-09T12:34:56Z).
• Money: Decimal strings with the currency in a separate field.
• Errors: RFC 7807 Problem Details with application/problem+json. Includes type, title, status, requestId, and (where applicable) missing (scopes), issues (validation).
• Request id: Pass X-Request-Id to correlate logs; the same id is echoed in the response.

Interactive reference

The full endpoint list, request/response schemas, and a built-in "try it" console are generated from the live OpenAPI spec at /api/v1/openapi.json, so they always match the running server.

Versioning

Within /v1, only additive changes are made (new endpoints, new optional fields). Breaking changes ship under /v2 and the previous version stays supported for at least 12 months.