Opencart REST API
Advanced REST API for OpenCart

Full control over your store through one secured API

Products, categories, orders, customers, returns, webhooks — all available through HMAC-signed HTTP requests. Sync OpenCart with ERP, accounting systems and marketplaces without core hacks.

API Reference (Redoc)
19
API resources
~68
endpoints
OpenAPI
3.0 + Postman
signed request
GET /index.php?route=api/advanced_api/product
X-Api-Key: ak_live_9f2c…
X-Api-Timestamp: 1753612800
X-Api-Signature:
// HMAC-SHA256(secret, string_to_sign)
METHOD ⏎ REQUEST_URI ⏎ TIMESTAMP ⏎ md5(body)
200 OK { "success": true, "products": [ … ] }

Every request is signed — no password in the body, protection against forgery and replay attacks.

Features

Built for real integration

Not just “reading data”, but a full store-management tool — from bulk sync to event webhooks.

HMAC-SHA256 protection

Signature over method, URI, time and body hash. ±300 s window against replay, IP whitelist and per-key rate limit.

Full CRUD

Products with descriptions, images, attributes, options and discounts. Categories, customers, coupons, reviews, SEO URLs — read and write.

Bulk synchronization

Update stock and prices of up to 500 products in a single request — ideal for accounting and ERP.

Event webhooks

Signed POSTs on order status changes, product updates and other events — instant updates to external systems.

Access rights and scopes

A “resource × action” matrix for each key. Precise control without unnecessary risk.

Multi-language and multi-store

Multilingual descriptions, store links, references for countries, zones, currencies and taxes.

↺ Method override (DELETE/PUT via POST)
⤒ Image upload
⏱ Per-key rate limiting
◈ Health-check ping
Interface

Manage right from the OpenCart admin panel

Keys, access rights, rate limits and license — all in the familiar module interface, no code editing.

Statistics & log assets/screenshots/stats.png
Statistics & log
Resources

19 resources — the whole store data model

A single base URL, consistent request and response structure. Each resource is documented with examples.

index.php?route=api/advanced_api/{resource}
Use cases

What it is for

One integration — many scenarios. From warehouse accounting to headless storefronts.

01

Sync with ERP / accounting

Upload stock and prices in batches, receive orders, change statuses — two-way exchange without manual work.

02

Marketplaces

Publish products, pull orders and import reviews from Rozetka, Prom, OLX through a single API.

03

Mobile apps and headless

Build your own storefront in React, Vue or Flutter on the fast OpenCart REST backend.

04

Automation and integrations

Webhooks trigger your scenarios on every order or status change — CRM, analytics, delivery.

Security

A signature that cannot be forged

The secret is never sent over the network. The client builds a string and signs it with HMAC-SHA256 — the server verifies the method, URI, time and body hash.

  • ✓ Replay protection: time drift from the server of no more than ±300 seconds.
  • ✓ IP whitelist and a request limit for each key.
  • ✓ Granular scopes — allow only the actions each integrator needs.
// string_to_sign
METHOD + "\n" +
REQUEST_URI + "\n" +
TIMESTAMP + "\n" +
md5(raw_body)
// signature
hash_hmac(
  'sha256',
  string_to_sign,
  api_secret
)
For developers

Ready to integrate in minutes

Specification, interactive reference and an auto-signing collection — everything to start without guesswork.

↳

Redoc reference

Interactive OpenAPI 3.0 documentation with all endpoints and schemas.

Open →
{ }

OpenAPI JSON

Machine-readable spec for generating clients and importing into Swagger.

Download →
▶

Postman collection

~68 requests with automatic HMAC signing — no manual signing needed.

Import →

Connect OpenCart to your ecosystem today

Install the module, create a key and make your first signed request in minutes.