Overview
The CanopyWMS partner API — a REST/JSON, server-to-server interface for purchase orders, orders, shipments, inventory, returns, and webhooks.
The CanopyWMS API is a REST, JSON-over-HTTPS interface for backend integrations. It's designed for server-to-server use — your systems authenticate with OAuth2 client credentials, with no reliance on a browser or session login.
With it you can create and track purchase orders, ingest and manage orders, buy and retrieve shipping labels, read inventory and returns, and subscribe to signed webhooks for order, shipment, purchase-order, and return events.
Authentication
OAuth2 client credentials, scopes, IP allowlisting, and environments.
Conventions
Idempotency, errors, rate limits, pagination, and incremental sync.
Endpoints
Purchase orders, orders, shipments, inventory, and returns — with samples.
Webhooks
Event catalog, signature verification, retries, delivery logs, and replay.
Base URLs and environments
The API runs in two isolated environments with the same surface, so you can build and test against a sandbox before going live.
| Environment | Base URL | Use |
|---|---|---|
| Production | https://api.canopywms.com | Live data. |
| Sandbox (staging) | https://api.staging.canopywms.com | Build and test; full parity for the PO lifecycle, order ingestion, label creation, and webhooks. |
Credentials are issued per environment — a sandbox credential never reaches production data, and vice versa.
At a glance
| Protocol | REST over HTTPS, JSON request/response bodies |
| Auth | OAuth2 client-credentials grant → short-lived bearer token (1-hour TTL) |
| Scopes | Per-resource read/write scopes; tokens are least-privilege |
| Tenancy | Each credential is scoped to one tenant (and optionally pinned to one client) |
| Safe retries | Idempotency-Key on every create; replays return the original response |
| Incremental sync | updatedSince + sortBy=updatedAt on orders, purchase orders, and shipments |
| Events | Outbound webhooks with HMAC-SHA256 signatures, retries, delivery logs, and replay |
| Rate limits | Per-credential, returned in standard rate-limit response headers |
Core objects
The API reads and writes these objects:
- Purchase orders (inbound shipments) — create with your own external PO number, idempotently; retrieve ordered/received quantities and status.
- Orders — ingest, update, hold/release/cancel; retrieve by your order number; sync incrementally.
- Shipments — buy labels; retrieve tracking, carrier/service, and the actual historical label cost.
- Inventory — read stock levels by SKU and by location.
- Returns — read RMAs and their lines.
Start with Authentication to mint your first token, then see Endpoints for the full operation list with sample requests and responses.