Get started with the API
The Fulify API lets another system read your catalog and push product data into it. Typical uses are an ERP or OMS that keeps Fulify up to date, an iPaaS flow (Make, n8n, Celigo, Workato and similar) that moves products between platforms, or a reporting job that reads the catalog.
Fulify is the source of truth. A write through the API lands in Fulify. It isn't pushed to your sales channels by itself. If you update a product that was already synced and has Channel Sync on, Fulify marks it as pending so the next sync picks the change up.
Base URL
All requests go to https://api.fulify.io/v1 over HTTPS, and request and response bodies are JSON. Every path in these docs is relative to the base URL. For example, GET /products means GET https://api.fulify.io/v1/products.
Create an API key
API keys are created in Settings → API Keys. Only organization admins can create or revoke keys.
- Go to Settings → API Keys and click Create key.
- Give the key a Name that says what uses it, for example "ERP feed".
- Choose its Access: one of the three presets below, or Custom to pick individual permissions.
- Choose an Expiry: Never, 24 hours, 30 days or 90 days.
- Copy the key from the API key created dialog and store it somewhere safe.
A key belongs to one organization. Everything it reads and writes is limited to that organization's catalog. To stop a key working, click Revoke next to it in the list.
Keys start with flfy_live_.
Access presets
When you create a key you pick its access level. A preset is a named set of scopes. If you pick scopes by hand and they don't match a preset exactly, the key shows as Custom.
| Preset | Reported as | What it can do |
|---|---|---|
| Read only | read | Read products and size charts. For reports, audits and checks against another system. |
| Edit catalogue | edit | Read and change products and size charts. It can't switch sync on, so nothing it does reaches a live system. |
| Full integration | full | Everything, including turning a product's sync switches and its Linnworks opt-in on or off. For an ERP or OMS that decides what goes where. |
| Custom | custom | Any other combination of scopes. |
New keys default to Read only. Give a key the least access it needs.
Scopes
Each preset is made of these scopes. A key has only the scopes chosen when it was created. A call that needs a scope the key lacks gets 403 forbidden_scope, and the message names the missing scope.
| Scope | Label in Settings | Grants |
|---|---|---|
| products:read | Read products | List and read products, including variants, categories and destination status. |
| products:write | Create and update products | Create and update products by SKU, including creating variants, and bulk-create variant groups. Sends nothing to your channels. |
| selection-guides:read | Read size charts | List and read selection guides (size charts) and which products carry them. |
| selection-guides:write | Manage size charts | Create, update and delete selection guides, and attach or detach them from products. |
| sync:write | Control sync | Set a product's master Sync switch, its Channel Sync switch and its Linnworks opt-in. Use with products:write. Sends data to live systems. |
The presets map to scopes like this:
- Read only:
products:read,selection-guides:read - Edit catalogue:
products:read,products:write,selection-guides:read,selection-guides:write - Full integration: all five, including
sync:write
A few boundaries are worth knowing:
- Variant groups use
products:write. There's no separate scope for them. - Attaching a size chart to products needs
selection-guides:write, notproducts:write. That way you can let a tool manage size charts without giving it the power to change prices. - Sync control needs
sync:writeas well asproducts:write. A key that only edits content can't start pushes to live systems.
Authenticate
Send the key as a bearer token in the Authorization header of every request:
A missing, invalid, revoked or expired key gets 401 unauthorized.
Make your first call
GET /me tells you which organization a key belongs to and what it can do. It's the quickest way to check a key before you debug anything else. Any valid key can call it.
access is the preset the key's scopes match: read, edit, full or custom.
To check that the API is up, call GET /health. It's the only endpoint that doesn't need a key.
Then read a page of products:
Next steps
- API reference: every endpoint, the shared conventions and the limits.
- Products: read, filter, page through and upsert products.
- Webhooks: get told when products change instead of polling.
- Errors and rate limits: what can go wrong and how to retry.