REST · JSON · Bearer token · Sandbox
Corporate merch API
REST API for corporate clients running their own procurement system, ERP or buying platform who need to integrate the merch operation with Quote, order, real-time status, quality evidence, tracking number and CFDI 4.0 download without going through email.
What the API is for
The API solves the six touchpoints between the client's procurement system and the shop's operation: quote with line breakdown, MOQ, lead time, print method and unit price in MXN before VAT; order with brief confirmation, sizes per SKU and delivery address; status in real time across the shop's stages (reception, art validation, production, quality control, packing, delivery); quality evidence with cut photo and signed report when AQL sampling applies; tracking number from the logistics operator; CFDI 4.0 with XML and PDF download when issued.
The API is not a marketing layer and not a shopping cart. It is a technical integration tool for clients with structured operations. If you operate with paper purchase orders and an owner who sends email, the API is not for you — and that is fine, not all clients need it.
Architecture and authentication
The API exposes REST endpoints with JSON payload. Authentication is via Bearer token delivered to the client's technical owner after the mutual NDA is signed. Each token is bound to a client account and a set of scopes: quote, order, status, evidence, billing. Endpoints are documented with OpenAPI 3.1 and the sandbox replicates production behavior with synthetic data.
Rate limit is 60 requests per minute per token, with sliding window. When the client's procurement system requires higher volume, it is evaluated case by case and the rate limit is adjusted with prior notice. Webhooks are sent from the shop to the client's system on key events: quote approved, production started, quality control passed, order shipped, CFDI issued. The webhook URL is configured in the client panel.
Main endpoints
The API contract is published as technical reference once the NDA is signed. The main endpoints are: POST /v1/quotes to create a quote from a structured brief; GET /v1/quotes/{id} to retrieve the quote with its breakdown; POST /v1/orders to confirm an order from an approved quote; GET /v1/orders/{id} to check order status at any moment; GET /v1/orders/{id}/timeline to reconstruct the history with timestamps per stage; GET /v1/orders/{id}/evidence to download quality control photos and, when applicable, the signed AQL report; GET /v1/orders/{id}/cfdi to download the CFDI 4.0 in XML and PDF; GET /v1/shipments/{tracking} to query the carrier's tracking number.
The sandbox exposes the same endpoints with synthetic data from already-delivered clients, products and orders. Clients with their own development team can test the integration without affecting their real operation.
Compatibility with common systems
We have integrated the API with clients running SAP Ariba, Coupa, Oracle Procurement Cloud and Latin American procurement platforms. Integration is normally on the client side: the procurement system calls the Corp-Merch.MX API to create a quote, receives the structured response, and triggers the internal approval flow before confirming the order. The CFDI 4.0 invoice is downloaded from the corresponding endpoint and reconciled against the PO in the ERP.
For clients without deep integration, we offer a web panel with the same information the API exposes: quote, order, status, evidence, tracking number and CFDI download. The panel is the human version of the API and is delivered at no additional cost as part of the service.
Security and compliance
Production endpoints run over HTTPS with TLS 1.3. Bearer tokens rotate every 90 days or whenever the client's technical owner changes. Webhooks are signed with HMAC-SHA256 so the client system verifies that the call comes from Corp-Merch.MX. Personal data processed by the API are those needed for billing and delivery — name, email, RFC when applicable, address — and are handled per the Federal Law on Protection of Personal Data Held by Private Parties.
Access logs are kept for 12 months for audit purposes. When the client requires evidence for its own internal audit or for a PROFECO or SAT visit, we deliver the access log for the corresponding period with authorization from the client's owner.
Cases where the API does not apply
There are three cases where the API is not the right tool. Client with one order a year: the cost of technical integration outweighs the benefit of automating; the web panel is enough. Client without a structured procurement system: when the order is raised by email and approved by wet signature, the API adds friction without simplifying. Exploratory brief: when the client does not yet know exactly what they need, the brief with a commercial owner is still the right path. The API applies when the client already has a recurring flow with Corp-Merch.MX and wants to automate.
Request sandbox access
If you have your own technical team and want to evaluate the integration, we deliver a sandbox token, OpenAPI 3.1 documentation and a typical test case. The transition to production happens after the mutual NDA is signed.
The Corp-Merch.MX API is a technical tool for corporate clients with a structured procurement system. It is not an end-consumer sales service and not a shopping cart. Endpoints, scopes and rate limits are documented to the client after the NDA is signed. Corp-Merch.MX operates independently and the API information reflects the capabilities at the time of publication.