← Back to docs

Omnifill API

Use the Omnifill API to automate fulfillment workflows, keep another site in sync, or power permission-based access checks without building your own order pipeline.

Orders Products Stock Email validation

How the API works

Omnifill has two common ways to authenticate:

API keys are intentionally limited. You can give each key only the capabilities you want, such as products, stock, or email validation.

Common endpoints

EndpointUse it for
POST /api/auth/loginStart a dashboard session for full account access.
POST /api/auth/2fa/verifyComplete a 2FA challenge when authenticator app 2FA is enabled.
GET /api/ordersRead normalized orders for the account.
POST /api/orders/importImport orders from another script or workflow.
GET /api/productsRead the product catalog and related fields.
GET /api/products/stockRead a lightweight stock feed for products with stock tracking enabled.
GET /api/validate-emailCheck whether a given email has purchased products and return the matching SKUs.
GET /api/analyticsRead summary metrics and simple breakdown views.

Using API keys

From the dashboard settings, you can create an API key and choose which capabilities it should have.

Products

Allow a key to access the product catalog.

Stock

Allow a key to read real stock values and remaining stock.

Email validation

Allow a key to check whether a specific email address has purchased products and return the related SKUs.

Example: email validation

curl "https://dashboard.omnifill.net/api/[email protected]" \
  -H "Authorization: Bearer your-api-key"

Example response:

{
  "email": "[email protected]",
  "hasPurchased": true,
  "skus": ["SKU-1", "SKU-2"]
}

Example: stock feed

curl "https://dashboard.omnifill.net/api/products/stock" \
  -H "Authorization: Bearer your-api-key"

This returns a simple list of products with stock values that can be shown on another website or internal system.

Notes

The API is meant to be practical and limited. It is best used for automation, read-only integrations, or simple permission checks rather than exposing your full account data.