Advanced REST API for OpenCart - 1.0.0 + openapi.json, Postman collection, environment

Demo

Admin panel: go

Login: demo

password: demo

Links to the documentation and API reference are available in the module's admin panel! 

🚀 Advanced REST API for OpenCart - professional integration of your store with any system

Advanced REST API is the most complete and secure REST API module for OpenCart, designed for stores that require deep integration with ERP systems, CRM, accounting software (SAP, Odoo, QuickBooks, Xero), marketplaces (Amazon, eBay, Etsy, Shopify, Walmart), shipping services (DHL, UPS, FedEx, USPS) and mobile applications.

The module provides a unified HTTP interface to all core store entities with support for HMAC-SHA256 request signing, a flexible access control system, and webhooks for reactive integrations.

✨ Key features

📦 Complete catalog management

• Products - create, read, update, delete with support for multilingual descriptions, gallery images, attributes, options (select, radio, checkbox, image, text, textarea, file, date, time, datetime), specials, discounts, related products, SEO URLs, layouts, reward points, downloads, filters
• Extended endpoint action=full - retrieve the most detailed product information (manufacturer, tax class, stock status, stores, layouts, reviews, rating) in a single request
• Bulk stock and price updates (bulk_stock) - up to 500 products per request with identification by product_id, SKU or model - ideal for ERP synchronization
• Categories - hierarchical structure with recursive deletion, multilingual descriptions, store bindings
• Manufacturers - CRUD with multilingual support and SEO
• Attributes and attribute groups - full management of product characteristics
• Product options - all OpenCart option types with multilingual values

🛒 Order management

• Orders - read, create new orders through native OpenCart logic, limited update of contact information
• Status history - order status changes with automatic customer email notification, stock deduction, reward point crediting and coupon application
• Order statuses - full CRUD for multilingual statuses
• Returns (RMA) - CRUD for return requests with reference lists of reasons, actions and statuses
• Filtering by date, customer, status, search by name and email

👥 Customers and marketing

• Customers - full CRUD with addresses, customer groups, newsletter subscriptions, secure password hashing (compatible with native OpenCart)
• Reviews - CRUD for importing reviews from marketplaces
• Coupons - percentage or fixed-amount discounts with product and category bindings
• Information pages (CMS) - management of static pages (About Us, Shipping, Privacy Policy)

🌐 Localization and reference data

• List of store languages and currencies
• Reference lists of countries, zones (regions), geo-zones
• Weight classes, length classes, stock statuses
• Tax classes and rates
• Customer groups and order statuses

🔗 SEO URLs

• Universal resource that automatically detects the SEO URL table structure of your build:
  • seo_url with key/value columns (OpenCart 3.0.3.0+)
  • seo_url with query column (ocStore 3.x)
  • url_alias (early OpenCart 3.0.x / 2.x)
• CRUD for any SEO URLs - products, categories, manufacturers, pages

🪝 Webhooks

• Subscribe to store events: order.add, order.status, product.add, product.update, product.delete, customer.add
• Wildcard * support - subscribe to all events
• Signed HMAC-SHA256 POST requests with X-Webhook-Event and X-Webhook-Signature headers
• Synchronous best-effort delivery with a short timeout - a slow subscriber does not block the API

🖼️ Image uploads

• Endpoint for uploading images via multipart/form-data
• Automatic sorting into image/catalog/ folders and subfolders
• Path traversal protection
• Support for jpg, jpeg, png, gif, webp formats

🏬 Multi-store

• Full support for OpenCart's multi-store configuration
• Binding products, categories, manufacturers, and pages to specific stores
• store resource for retrieving the list of stores

🔒 Security and access control

• HMAC-SHA256 request signing - protection against forgery and replay attacks
• Timestamp validation - deviation from server time not exceeding ±300 seconds
• IP whitelist - restrict access by IP addresses
• Rate limiting - configurable per-minute request limit for each API key
• Granular scopes - visual resource × action matrix (Read / Create / Update / Delete) for each key
• DELETE toggle - separate control over deletion permission for each key
• License key with domain binding (supports www and subdomains)

🛠️ Bypassing server restrictions (Method Override)

If your hosting blocks DELETE and PUT HTTP methods (a common problem on shared hosting), the module supports method override via POST with the &method=delete or &method=put parameter. The signature remains unchanged - all permission and scope checks work natively.

📚 Documentation and developer tools

• OpenAPI 3.0 specification - complete machine-readable document (docs/openapi.json) and live /spec endpoint
• Interactive Redoc reference - docs/api.html
• Ready-to-use Postman collection - 19 folders by resource, ~68 requests with automatic HMAC signing via a pre-request script (CryptoJS)
• Request body checklist - all endpoints with ready-made JSON bodies for copying
• Examples in PHP, cURL, bash
• Unified response codes: 200, 201, 400, 401, 403, 404, 405, 429
• Uniform error format for easy client-side parsing

🎯 Who this module is for

• OpenCart 2.x, 3.x, ocStore online stores that need automation
• Mobile app developers for iOS/Android storefronts
• Accounting system integrators - SAP, Odoo, QuickBooks, Xero, NetSuite
• Marketplace suppliers - Amazon, eBay, Etsy, Walmart, Shopify, Rozetka, Prom.ua
• Stock synchronization services and price aggregators
• Shipping services - DHL, UPS, FedEx, USPS - for automatic status updates
• PIM system developers and catalogers
• CRM integrators - HubSpot, Salesforce, Pipedrive, Zoho, Bitrix24
• BI systems and analytics - data exports for reports

💡 Example use cases

1. Catalog synchronization with ERP - hourly stock and price updates via the bulk endpoint
2. Automatic order import from marketplaces - creating orders via API with native OpenCart event triggering
3. Store mobile app - full catalog, cart and customer profile functionality
4. Automatic order status changes - integration with TMS for updates upon shipping
5. Review imports from marketplaces - regular pulling of reviews from Amazon, eBay
6. Reactive CRM - webhooks on order.add and customer.add for instant deal creation
7. Bulk SEO URL updates - after catalog structure changes

⚙️ Technical requirements

• OpenCart 2.x, 3.x (all minor versions)
• ocStore 3.x
• PHP 7.4+ (compatible with PHP 8.x)
• MySQL 5.6+ / MariaDB 10+
• OpenSSL extension for HMAC