REST · Webhooks · OAuth 2.0 · OpenAPI 3.0
The REST API that exposes the catalogue, order creation, status tracking, CFDI 4.0 invoice retrieval and batch traceability for integration with ERP, CRM, HR platforms and customer portals. Documented in OpenAPI 3.0 with sandbox and production environments.
The Corp-Merch API follows REST principles with JSON payloads and OAuth 2.0 authentication. Each integration requires a client ID and a client secret, exchanged for an access token with defined expiry and refresh token rotation. Tokens are scoped to specific customer and operation; permission escalation requires explicit re-authorisation.
The API runs over HTTPS with TLS 1.2 or higher. All requests are logged with timestamp, source IP, customer and operation. Rate limits are applied per client and per customer; the documentation specifies the limit per endpoint and the recommended retry pattern with exponential backoff.
The catalogue endpoint exposes the full product catalogue with pagination, filters by category, region, material, certification and minimum order quantity. Each product includes reference, name, description, variants, MOQ, lead time, base price, applicable regulatory constraints and customisation options. The catalogue supports Spanish, English and Russian for the three locales of the platform.
Catalogue synchronisation with the customer's system happens by event — creation, deletion, price change, variant change — or by full snapshot on demand. The catalogue endpoint also exposes availability by date range, allowing the customer to plan orders aligned to capacity.
Orders are created via the orders endpoint with the items, quantities, customisation, recipient details and delivery address. The endpoint returns the order identifier, the assigned commercial owner, the production start date estimate and the delivery date estimate. Order status transitions are: created, artwork approval, production, quality control, shipment, delivered, closed.
Order status tracking is exposed via the orders endpoint and via webhooks. The customer can poll the orders endpoint at the frequency they require or subscribe to webhooks for automatic notifications. The tracking number is included once the shipment is dispatched.
The invoices endpoint returns CFDI 4.0 invoices in XML and PDF format with the SAT signature, UUID, receptor details, item breakdown, IVA breakdown and, where applicable, Carta Porte 3.0 complement. Invoices can be downloaded per order or per period, with filtering by issue date, status and UUID prefix.
The traceability endpoint exposes batch data per order: material certificates, supplier certificates, chain of custody where applicable, laboratory test reports where required, and conformity declaration signed by the workshop owner. The documentation is available per batch and per order, with timestamp and retention period per regulatory requirement.
Webhooks notify the customer of relevant events — order created, artwork approved, production started, quality control completed, shipment dispatched, delivery confirmed. Each event carries a JSON payload with minimum necessary information and a unique identifier for deduplication. The customer configures the endpoint and the events they want to receive; unconsumed events are retried with exponential backoff for twenty-four hours.
Webhook security is guaranteed with HMAC-SHA256 signature on the payload, with shared key rotated every ninety days. The customer verifies the signature before processing the event; events with invalid signature are rejected and logged. The documentation includes payload examples for each event type and the error codes the customer may receive.
The API exposes two environments. Sandbox: workshop-mock data, no real production, allows integration testing without consuming real capacity. Production: real data, real production, requires explicit go-live approval from the customer.
The documentation specifies the migration process from sandbox to production, including: complete checklist of tested scenarios, customer signature of go-live approval, thirty-day post-go-live support window, error monitoring and customer notification for incidents.
OAuth 2.0 with client ID and client secret exchanged for access token. Tokens are scoped to customer and operation; rotation is supported.
Rate limit per client and per customer is documented per endpoint. The recommended pattern is exponential backoff retry. Limits can be raised per customer request.
Yes. Sandbox uses mock data without consuming real capacity; production requires explicit go-live approval. Migration checklist and post-go-live support are documented.
Yes. Webhooks are signed with HMAC-SHA256 on the payload, with shared key rotated every ninety days. The customer verifies the signature before processing.
If your company is evaluating integration with the Corp-Merch API, let's talk. We deliver the OpenAPI 3.0 specification, the sandbox credentials and the post-go-live support plan.
The API documented on this page reflects the workshop's offer at the time of publication. Availability of each endpoint, rate limits and integration patterns must be verified at the time of each integration. Corp-Merch.MX is a Mexican workshop for corporate merch production; we operate independently and the technical information on this page does not constitute integration advice or contractual commitment until confirmed in writing by the commercial and technical areas.