Get started securely with the Abicart API

Connect an external system to Abicart with the correct protocol, store context, and permissions.

This guide is for store owners who order an integration and developers who build it. API access is included in the current Go, Plus, and Pro plans; development work, supplier agreements, and other add-ons are not automatically included. An API is a way for systems to communicate, not a ready-made integration that starts syncing on its own.

1. Choose a task and check the method

Common uses include product data, orders, inventory, customer/business systems, and reporting. Payment and shipping also require the right methods, supplier agreements, and transaction handling. Read the developer guide for each method's parameters and side effects before you build the flow.

2. Use the correct protocol and store

The API is JSON-RPC 2.0 via HTTPS or secure WebSocket (WSS). It is not REST just because the call is made over HTTP. The HTTPS endpoint is https://admin.abicart.se/backend/jsonrpc/v1. Select the webshop and, if necessary, the language/currency according to the method's documented context.

The following read-only message lists a limited selection of themes. It illustrates the JSON-RPC format and requires the correct store context in the call; it is not a complete authentication or sync program:

{"jsonrpc":"2.0","id":1,"method":"Theme.list","params":[{"uid":true,"active":true},{"filters":{"/active":true},"limit":10}]}

A public read method may have different access than order or customer data. The fact that a public Theme call works does not prove that the token or other permissions are set correctly.

3. Handle the AuthToken securely

1. Create and manage the key through an authorized administrator login and give it a clear purpose. The token alone is not sufficient to manage tokens.
2. Treat an AuthToken as a secret administrator key for the associated main store and its sub-stores, subject to each API method's permission rules. It is not a personal, automatically restricted copy of a particular employee's permissions and has no separate general read-only mode.
3. Provide the secret only to the intended integrator through a secure channel. Do not include it in public JavaScript code, URL examples, version control, or support screenshots.
4. Revoke a token that should no longer be used by deactivating or deleting it. A short cache can affect immediate effect; a token does not have the same general lifespan as a regular login session.

4. Handle responses, lists, and retries

1. Match the response ID to the correct request.
2. Check the JSON-RPC error object even if the HTTP call was successful. Read the error code and the method's conditions before retrying.
3. Paginate lists according to the method's documentation. The normal list limit is 500 unless the method specifies otherwise; do not assume that the first page contains the entire dataset.
4. Keep reads and writes separate. After an uncertain write, you need to check the actual outcome before retrying, especially for orders and financial actions.

No common requests-per-second figure is specified here; follow the method and operational conditions in the current documentation. When troubleshooting, collect the method, anonymized error object, timestamp, and store context, but no secrets or unnecessary customer data.

Quick start

1. Define the task and verify the correct method in the developer guide.
2. Select the store, protocol, and necessary permissions.
3. Start with a limited read and check the error/result.
4. Build pagination, permission checks, and safe retries before a writing sync.

Subscription and access

The API is available in Go, Plus, and Pro. Method permissions, the correct main store/sub-store context, and supplier terms must still be met. AuthToken is an administrator key for the associated store family, not a personal permission profile. API access does not automatically include development or external services.