Delivery Syria
العربية

Developers

APIs and webhooks.

  • API overview: the merchant and company APIs The platform's two public APIs: the merchant API at /api/v1 (sk_ key) and the company API at /api/company/v1 (ck_ key), who can use them, how versions work and the JSON envelope every response uses. Concept Developers
  • Authentication and API keys How to create a merchant (sk_) or company (ck_) API key in the panel, send it as an Authorization Bearer header, what each key prefix means and which error a missing, wrong or plan-blocked key returns. Guide Developers
  • Merchant API v1 reference Every merchant API v1 endpoint under /api/v1: method, path, parameters with validation rules and response shape, with curl, JavaScript, PHP and Python samples for creating, listing and tracking parcels. Reference Developers
  • Company API v1 reference Every company API v1 endpoint under /api/company/v1: merchants, couriers, parcels, creating a parcel, assigning a courier and updating status, with parameters, responses and curl, JavaScript, PHP and Python samples. Reference Developers
  • Errors and status codes The real HTTP status and error codes of the merchant and company APIs: the error shape, the order of the checks, a table with the meaning and fix of each code, 422 validation errors and how to handle them. Reference Developers
  • API rate limits as actually enforced The limits the code really enforces on /api: 60 requests per minute per IP address, route limits, plan limits per minute and per day, and what a 429 looks like. The panel's older per-key figures (120 and 300) are not enforced per key; the real limits are per IP address plus your plan limits. Reference Developers
  • Pagination and filters in the API How API lists are paginated (page, per_page, meta) and which filters really work, including the merchant stage values: processing and awaiting_funds are ignored, while the company API rejects unknown values. Reference Developers
  • Outgoing webhooks: instant notifications to your system What outgoing webhooks are: the ten events plus ping, message format and headers, registering a URL in the panel or API, URL rules (https, ports 443 and 8443, public address), plan flag and limits. Concept Developers
  • Verify the webhook signature (X-DS-Signature) How to verify X-DS-Signature: sha256= plus HMAC-SHA256 of timestamp.body, exact header names, a test vector, and working PHP, Node.js and Python code with constant-time comparison and a timestamp check. Guide Developers
  • Webhook retries, failures and automatic suspension Eight attempts with waits from 1 minute to 24 hours, automatic suspension after 40 consecutive failures, the message log and resend, and how to recover after your system was down. Reference Developers
  • API versions and safe retries (idempotency) The version is only the path prefix (/api/v1, /api/company/v1). There is no Idempotency-Key support; safe retries rely on the parcel reference field. Reference Developers
  • Inbound webhooks and callbacks: stores, Store Syria and partners Reference for the requests the platform receives: Salla, Zid, Shopify and WooCommerce store events, the legacy Store Syria API, and carrier and payment callbacks, with verification and effects. Reference Developers
  • In-panel API documentation and public helper endpoints What the two in-panel API documentation pages contain, the limits and error codes the API applies, and the small public helper endpoints for governorates, delivery charges, newsletter and contact. Reference Developers