nOfert |
API Reference v2.0
Get API Key โ†’
API v2.0 โ€” 157 Endpoints โ€” Live

nOfert API

A complete REST API for the nOfert marketplace. Fetch products, manage orders, receive real-time webhooks, and build any integration you can imagine.

๐Ÿ“ฆ

Products & Reviews

Search, filter, review

๐Ÿ›’

Cart & Orders

Full shopping flow

๐Ÿ‘ค

User Account

Profile, wishlist, addresses

โšก

157 Endpoints

Webhooks, tickets, blog

๐Ÿš€ Quick Start

Make your first API call in under 2 minutes.

1

Get an API key

Sign in to your vendor account, go to Vendor โ†’ API Keys, and click Create Key.

โ†’ Go to API Keys
2

Test your key

curl "https://nofert.net/api/v1/me" \
  -H "Authorization: Bearer nofert_your_key_here"
3

Fetch products

curl "https://nofert.net/api/v1/products?search=shoes&sort=price_asc&per_page=10"

Public endpoints need no key โ€” just call them directly.

๐Ÿ” Authentication

The API uses two types of authentication depending on what you are accessing.

API Key nofert_โ€ฆ

For vendor integrations โ€” create orders, read your key info, receive webhooks. Generate from your vendor dashboard.

User Token nofert_u_โ€ฆ

For user-specific data โ€” profile and order history. Obtained by logging in via POST /auth/login.

Pass your token in one of two ways:

# Recommended: HTTP Authorization header
curl -H "Authorization: Bearer nofert_your_key" https://nofert.net/api/v1/me

# Alternative: query parameter
curl "https://nofert.net/api/v1/me?api_key=nofert_your_key"
Badge legend: public No key required (rate limited by IP) ยท requires key Vendor API key ยท user token User login token

โฑ๏ธ Rate Limits

Access typeLimitWindow
Public (no key, by IP)120 requestsper minute
API key (default)1,000 requestsper hour

Every authenticated response includes three standard headers so your app can manage usage proactively:

X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 997
X-RateLimit-Reset: 1740412800    # Unix timestamp โ€” when the window resets
When exceeded, the API returns HTTP 429 with a retry_after field (seconds until the limit resets).

โš ๏ธ Error Responses

All errors return JSON. Always set Accept: application/json to receive JSON errors instead of HTML.

StatusMeaningExample
400Bad request / validation failedMissing required field
401Missing or invalid API key / tokenExpired or revoked key
403Insufficient permissionsKey lacks this permission
404Resource not foundUnknown product ID
422Unprocessable entityProduct out of stock
429Rate limit exceededToo many requests
// Error response shape
{
  "error": "Invalid or expired API key."
}

// Rate limit exceeded
{
  "error": "Rate limit exceeded.",
  "retry_after": 3412
}

๐Ÿ  Homepage & App Config

GET /api/v1/app/config public 60 req/min

Bootstrap endpoint for mobile apps. Returns store name, currency, payment methods, categories, feature flags, and social login availability. Call once on app launch.

Request

curl "https://nofert.net/api/v1/app/config"

Response

{
  "store_name": "Nofert",
  "currency": "EUR",
  "currency_symbol": "โ‚ฌ",
  "payment_methods": ["stripe", "paypal", "cod"],
  "features": {
    "reviews": true,
    "wishlist": true,
    "blog": true
  },
  "social_login": {
    "google": true,
    "facebook": true
  },
  "categories": [
    { "id": 1, "name": "Electronics", "slug": "electronics" }
  ]
}
GET /api/v1/app/home public 60 req/min

Homepage data for mobile apps. Returns promotional banners, featured products, new arrivals, on-sale items, flash deals, and top categories โ€” everything needed to render the home screen.

Request

curl "https://nofert.net/api/v1/app/home"

Response

{
  "banners": [
    { "id": 1, "title": "Summer Sale", "image": "https://...", "link": "/deals" }
  ],
  "featured": [
    { "id": 42, "name": "Running Shoes", "price": "59.99", ... }
  ],
  "new_arrivals": [ ... ],
  "on_sale": [ ... ],
  "flash_deals": [ ... ],
  "categories": [
    { "id": 1, "name": "Electronics", "image": "https://...", "product_count": 142 }
  ]
}

๐Ÿ“ฆ Products

GET /api/v1/products public 120 req/min ยท no key needed

List and filter approved products. Supports full-text search, price ranges, category, stock status, and bulk ID lookup.

Query Parameters

ParameterTypeDescription
searchstringFull-text search in name and description
idsstringComma-separated product IDs โ€” bulk lookup, e.g. ?ids=1,2,3 (max 100)
categoryintegerFilter by category ID
vendorstringFilter by vendor shop slug
min_pricenumberMinimum price (inclusive)
max_pricenumberMaximum price (inclusive)
in_stockbooleanOnly return in-stock products
featuredbooleanOnly return featured products
sortenumnewest ยท price_asc ยท price_desc ยท popular
per_pageintegerResults per page, 1โ€“100 (default: 20)
pageintegerPage number

Request

curl "https://nofert.net/api/v1/products?search=shoes&sort=price_asc&per_page=5"

# Bulk lookup
curl "https://nofert.net/api/v1/products?ids=42,87,103"

Response

{
  "data": [
    {
      "id": 42,
      "name": "Running Shoes",
      "slug": "running-shoes",
      "price": "59.99",
      "sale_price": "49.99",
      "quantity": 100,
      "rating": 4.8,
      "category": { "id": 3, "name": "Footwear" },
      "vendor": { "name": "Sport Store" }
    }
  ],
  "meta": {
    "current_page": 1,
    "last_page": 5,
    "total": 48,
    "currency": "EUR",
    "currency_symbol": "โ‚ฌ"
  }
}
GET /api/v1/products/{id} public

Get a single product with full details โ€” all images, variants, and reviews.

Request

curl "https://nofert.net/api/v1/products/42"

Response

{
  "data": {
    "id": 42,
    "name": "Running Shoes",
    "description": "...",
    "price": "59.99",
    "sale_price": "49.99",
    "quantity": 100,
    "images": [ { "url": "https://..." } ],
    "variants": [
      { "id": 7, "name": "Blue / Size 42", "price": "59.99" }
    ],
    "reviews_count": 24,
    "rating": 4.8
  }
}
GET /api/v1/products/{id}/questions public

Public Q&A for a product. Returns answered questions with pagination.

ParameterTypeDescription
per_pageinteger1โ€“50 (default: 15)
curl "https://nofert.net/api/v1/products/42/questions"
POST /api/v1/products/{id}/questions user token 10 req/min

Ask a question about a product. Questions are pending until vendor/admin answers.

FieldTypeDescription
question *stringYour question (10โ€“1000 chars)
curl -X POST "https://nofert.net/api/v1/products/42/questions" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "question=Does this come with a warranty?"

โญ Product Reviews

GET /api/v1/products/{id}/reviews public

Approved customer reviews for a product, including average rating and star-by-star breakdown.

ParameterTypeDescription
sortenumnewest ยท highest ยท lowest ยท helpful
per_pageinteger1โ€“50 (default: 10)
curl "https://nofert.net/api/v1/products/42/reviews?sort=helpful&per_page=5"
POST /api/v1/products/{id}/reviews user token

Submit a review for a product. Requires a delivered purchase. Reviews are pending until admin approval. Supports image uploads.

FieldTypeDescription
rating *integer1โ€“5 stars
commentstringReview text (max 2000 chars)
images[]fileUp to 5 images (jpeg, png, webp, max 2MB each)
curl -X POST "https://nofert.net/api/v1/products/42/reviews" \
  -H "Authorization: Bearer nofert_u_..." \
  -F "rating=5" \
  -F "comment=Excellent quality!" \
  -F "images[]=@photo.jpg"
DELETE /api/v1/user/reviews/{id} user token

Delete your own review.

curl -X DELETE "https://nofert.net/api/v1/user/reviews/19" \
  -H "Authorization: Bearer nofert_u_..."

๐Ÿ—‚๏ธ Categories

GET /api/v1/categories public

Returns the full category tree with product counts at every level.

Request

curl "https://nofert.net/api/v1/categories"

Response

{
  "data": [
    {
      "id": 1,
      "name": "Electronics",
      "slug": "electronics",
      "product_count": 142,
      "children": [
        { "id": 5, "name": "Phones", "product_count": 48 }
      ]
    }
  ]
}

๐Ÿช Vendors

GET /api/v1/vendors public

Paginated list of approved vendors. Filter by name or verification status.

ParameterTypeDescription
searchstringSearch by shop name
verifiedbooleanOnly return verified vendors
per_pageintegerResults per page (default: 20)
curl "https://nofert.net/api/v1/vendors?verified=true&per_page=10"
GET /api/v1/vendors/{slug} public

Get a vendor's full profile, bio, ratings, and their most recent products.

curl "https://nofert.net/api/v1/vendors/my-shop"
GET /api/v1/vendors/{slug}/reviews public

Reviews for all products sold by this vendor, with aggregate stats (total count and average rating).

ParameterTypeDescription
per_pageinteger1โ€“50 (default: 15)

Request

curl "https://nofert.net/api/v1/vendors/my-shop/reviews?per_page=5"

Response

{
  "data": [
    {
      "id": 1,
      "rating": 5,
      "comment": "Great seller!",
      "user": "Jane D.",
      "product": "Running Shoes",
      "created_at": "2026-02-20T10:00:00Z"
    }
  ],
  "meta": {
    "total_reviews": 24,
    "average_rating": 4.6,
    "current_page": 1,
    "last_page": 5
  }
}

๐Ÿ“ Blog

GET /api/v1/blog public

List published blog posts with excerpts (no full content). Filterable by category.

ParameterTypeDescription
categorystringFilter by category name
per_pageintegerResults per page (default: 15)
curl "https://nofert.net/api/v1/blog?per_page=5"
GET /api/v1/blog/{slug} public

Get a single blog post with full HTML content.

curl "https://nofert.net/api/v1/blog/my-post-slug"

๐Ÿ”ฅ Deals & Promotions

GET /api/v1/deals public

Returns active flash deals with products and active promotional banners.

curl "https://nofert.net/api/v1/deals"

๐Ÿท๏ธ Coupons

POST /api/v1/coupons/validate public 30 req/min

Validate a coupon code and get discount details. Rate limited to 30 req/min to prevent brute-force.

FieldTypeDescription
code *stringCoupon code to validate

Request

curl -X POST "https://nofert.net/api/v1/coupons/validate" \
  -H "Content-Type: application/json" \
  -d '{ "code": "SUMMER20" }'

Response

{
  "valid": true,
  "code": "SUMMER20",
  "type": "percentage",
  "value": 20,
  "min_order": 50
}

๐Ÿ›’ Orders

POST /api/v1/orders requires key permission: orders:create

Create a pending order and receive a checkout_url โ€” redirect your customer there to complete payment on nOfert.

FieldTypeDescription
customer_name *stringCustomer full name
customer_email *emailCustomer email address
customer_phonestringCustomer phone number
shipping_address *stringStreet address
shipping_city *stringCity
shipping_country *stringCountry name
shipping_zipstringPostal / ZIP code
notesstringOrder notes (max 1000 chars)
items *arrayArray of line items (1โ€“50)
items[].product_id *integerProduct ID
items[].variant_idintegerVariant ID (optional)
items[].quantity *integerQuantity, 1โ€“999

Request

curl -X POST "https://nofert.net/api/v1/orders" \
  -H "Authorization: Bearer nofert_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_name": "Jane Doe",
    "customer_email": "jane@example.com",
    "shipping_address": "123 Main St",
    "shipping_city": "Pristina",
    "shipping_country": "Kosovo",
    "items": [
      { "product_id": 42, "quantity": 2 },
      { "product_id": 7, "variant_id": 15, "quantity": 1 }
    ]
  }'

Response (201)

{
  "data": {
    "order_number": "ORD-20260219-XK42",
    "status": "pending",
    "payment_status": "pending",
    "total": 169.97,
    "currency": "EUR"
  },
  "checkout_url": "https://nofert.net/order/ORD-20260219-XK42/confirmation",
  "message": "Order created. Redirect your customer to checkout_url."
}
GET /api/v1/orders/{order_number} requires key

Get the current status and details of an order created through your API key.

Request

curl "https://nofert.net/api/v1/orders/ORD-20260219-XK42" \
  -H "Authorization: Bearer nofert_your_key"

Response

{
  "data": {
    "order_number": "ORD-20260219-XK42",
    "status": "shipped",
    "payment_status": "paid",
    "total": 169.97,
    "tracking_number": "1Z999AA1",
    "tracking_carrier": "DHL",
    "items": [ ... ]
  }
}

๐Ÿ”‘ Me โ€” Key Info

GET /api/v1/me requires key

Returns information about the current API key โ€” great for verifying your key works and checking your rate limit status.

Request

curl "https://nofert.net/api/v1/me" \
  -H "Authorization: Bearer nofert_your_key"

Response

{
  "name": "My Mobile App",
  "owner": "Herolind",
  "permissions": ["all"],
  "rate_limit": "1000/hour",
  "last_used_at": "2026-02-19T21:00:00.000Z",
  "expires_at": null
}

๐Ÿ‘ค User Authentication

User tokens allow your app to act on behalf of a logged-in user โ€” reading their profile, order history, and more. They are separate from vendor API keys.

POST /api/v1/auth/login public

Exchange email and password for a 30-day user token. Rate-limited to 10 attempts per minute per IP.

FieldTypeDescription
email *emailUser's email address
password *stringUser's password
device_namestringLabel for this token (e.g. "iPhone App")

Request

curl -X POST "https://nofert.net/api/v1/auth/login" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com",
    "password": "secret",
    "device_name": "My App"
  }'

Response

{
  "token": "nofert_u_4a8b2c...",
  "expires_at": "2026-03-20T10:00:00.000Z",
  "user": {
    "id": 5,
    "name": "Jane Doe",
    "email": "user@example.com",
    "role": "buyer"
  }
}
POST /api/v1/auth/register public

Create a new buyer account and receive a 30-day user token.

FieldTypeDescription
name *stringFirst name (min 2 chars)
email *emailMust be unique
password *stringMin 8 characters
password_confirmation *stringMust match password
device_namestringToken label (e.g. "iPhone")
curl -X POST "https://nofert.net/api/v1/auth/register" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Jane",
    "email": "jane@example.com",
    "password": "secret123",
    "password_confirmation": "secret123"
  }'
POST /api/v1/auth/forgot-password public

Send a password reset link to the user's email.

FieldTypeDescription
email *emailRegistered email address
curl -X POST "https://nofert.net/api/v1/auth/forgot-password" \
  -d "email=jane@example.com"
POST /api/v1/auth/reset-password public

Reset a user's password using the token from the email link. Revokes all existing user tokens.

FieldTypeDescription
email *emailUser's email
token *stringReset token from email
password *stringNew password (min 8 chars)
password_confirmation *stringMust match password
curl -X POST "https://nofert.net/api/v1/auth/reset-password" \
  -H "Content-Type: application/json" \
  -d '{ "email": "jane@example.com", "token": "abc123...", "password": "newpass!", "password_confirmation": "newpass!" }'
POST /api/v1/auth/social/{provider} public

Social login via Google or Facebook. Exchange a provider access token for a user token. Creates the account automatically on first login.

FieldTypeDescription
access_token *stringOAuth access token from Google/Facebook SDK
device_namestringToken label
curl -X POST "https://nofert.net/api/v1/auth/social/google" \
  -H "Content-Type: application/json" \
  -d '{ "access_token": "ya29.a0AfH6SM..." }'
POST /api/v1/auth/logout user token

Permanently revokes the current user token.

curl -X POST "https://nofert.net/api/v1/auth/logout" \
  -H "Authorization: Bearer nofert_u_4a8b2c..."

# Response: { "message": "Logged out successfully." }
POST /api/v1/auth/refresh user token

Extend the current token's expiry by 30 days.

curl -X POST "https://nofert.net/api/v1/auth/refresh" \
  -H "Authorization: Bearer nofert_u_4a8b2c..."

# Response: { "message": "Token refreshed.", "expires_at": "2026-04-20T..." }

๐Ÿ™‹ User Profile

GET /api/v1/user user token

Returns the authenticated user's profile.

curl "https://nofert.net/api/v1/user" \
  -H "Authorization: Bearer nofert_u_..."
PUT /api/v1/user user token

Update the authenticated user's profile fields. Only send the fields you want to change.

FieldTypeDescription
namestringFirst name (min 2 chars)
last_namestringLast name
phonestringPhone number
addressstringStreet address
citystringCity
zipstringZIP / postal code
countrystringCountry
curl -X PUT "https://nofert.net/api/v1/user" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "phone=+38349123456" -d "city=Pristina"
PUT /api/v1/user/password user token

Change the user's password. Requires the current password for verification.

FieldTypeDescription
current_password *stringCurrent password
password *stringNew password (min 8 chars)
password_confirmation *stringMust match new password
curl -X PUT "https://nofert.net/api/v1/user/password" \
  -H "Authorization: Bearer nofert_u_..." \
  -H "Content-Type: application/json" \
  -d '{ "current_password": "old", "password": "new123!", "password_confirmation": "new123!" }'

๐Ÿ“‹ User Orders

GET /api/v1/user/orders user token

Returns the authenticated user's order history. Filterable by status.

ParameterTypeDescription
statusenumpending ยท processing ยท shipped ยท delivered ยท cancelled
per_pageinteger1โ€“50 (default: 15)
curl "https://nofert.net/api/v1/user/orders?status=shipped" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/orders/{orderNumber}/cancel user token

Cancel a pending or processing order. Orders that are already shipped/delivered cannot be cancelled.

curl -X POST "https://nofert.net/api/v1/user/orders/ORD-ABC123/cancel" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/orders/{orderNumber}/return user token

Request a return for a delivered order. Only one open return request per order.

FieldTypeDescription
reason *stringReturn reason (max 2000 chars)
curl -X POST "https://nofert.net/api/v1/user/orders/ORD-ABC123/return" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "reason=Item arrived damaged"

๐Ÿงพ Invoice & Tracking

GET /api/v1/user/orders/{orderNumber}/invoice user token

Returns full invoice data as JSON โ€” items with variants, shipping address, tax, discount, and store info. Designed for mobile apps to render invoices natively.

curl "https://nofert.net/api/v1/user/orders/ORD-ABC123/invoice" \
  -H "Authorization: Bearer nofert_u_..."
GET /api/v1/user/orders/{orderNumber}/tracking user token

Returns order tracking timeline with status steps. Each step shows whether it's completed and when. Includes tracking number and carrier if available.

curl "https://nofert.net/api/v1/user/orders/ORD-ABC123/tracking" \
  -H "Authorization: Bearer nofert_u_..."

Response Example

{
  "order_number": "ORD-ABC123",
  "current_status": "shipped",
  "tracking_number": "1Z999AA10123456784",
  "tracking_carrier": "UPS",
  "timeline": [
    { "status": "placed", "label": "Order Placed", "completed": true, "date": "2026-02-25T10:00:00Z" },
    { "status": "processing", "label": "Processing", "completed": true, "date": "2026-02-25T14:00:00Z" },
    { "status": "shipped", "label": "Shipped", "completed": true, "date": "2026-02-26T09:00:00Z" },
    { "status": "delivered", "label": "Delivered", "completed": false, "date": null }
  ]
}

๐Ÿ—‘๏ธ Account Deletion

GDPR and App Store compliant account deletion. The account is anonymized and soft-deleted โ€” order history is preserved but personal data is removed.

DELETE /api/v1/user user token

Permanently delete the authenticated user's account. Requires password verification. You cannot delete your account while you have active (pending/processing/shipped) orders.

FieldTypeDescription
password *stringCurrent password for verification

What happens: API tokens revoked, push tokens deleted, personal data anonymized (name โ†’ "Deleted User", email โ†’ deleted_ID@removed.invalid), account soft-deleted.

curl -X DELETE "https://nofert.net/api/v1/user" \
  -H "Authorization: Bearer nofert_u_..." \
  -H "Content-Type: application/json" \
  -d '{ "password": "your-current-password" }'

๐Ÿ’ฌ Messages

Real-time messaging between buyers and vendors. Supports text messages with optional file attachments and typing indicators.

GET /api/v1/user/messages user token

List all conversations. Returns the latest message from each chat partner, sorted by most recent.

ParameterTypeDescription
per_pageinteger1โ€“50 (default: 20)
curl "https://nofert.net/api/v1/user/messages" \
  -H "Authorization: Bearer nofert_u_..."
GET /api/v1/user/messages/{userId} user token

Get message history with a specific user. Use ?after= for efficient polling โ€” only returns messages newer than the given timestamp.

ParameterTypeDescription
afterISO 8601Only return messages after this timestamp (for polling)
per_pageinteger1โ€“100 (default: 50)
curl "https://nofert.net/api/v1/user/messages/42?after=2026-02-27T10:00:00Z" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/messages/{userId} user token

Send a message to another user. Supports up to 5 file attachments (images, documents โ€” max 5MB each). Rate limited to 30 requests per minute.

FieldTypeDescription
message *stringMessage text (max 5000 chars)
attachments[]file[]Up to 5 files (max 5MB each)
curl -X POST "https://nofert.net/api/v1/user/messages/42" \
  -H "Authorization: Bearer nofert_u_..." \
  -F "message=Hello, is this product still available?" \
  -F "attachments[]=@photo.jpg"
POST /api/v1/user/messages/{userId}/typing user token

Send a typing indicator. The indicator expires after 30 seconds. Call this periodically while the user is typing.

curl -X POST "https://nofert.net/api/v1/user/messages/42/typing" \
  -H "Authorization: Bearer nofert_u_..."

๐Ÿ›’ Cart

Persistent server-side cart. Items survive token rotation and last 30 days. Cart key format: productId:variantId (e.g. 42:7 or 42:0 for no variant).

GET /api/v1/cart user token

Get cart contents with product details, images, subtotal, and item count.

Request

curl "https://nofert.net/api/v1/cart" \
  -H "Authorization: Bearer nofert_u_..."

Response

{
  "data": [
    {
      "key": "42:0",
      "product_id": 42,
      "product_name": "Running Shoes",
      "variant_id": null,
      "quantity": 2,
      "price": 49.99,
      "total": 99.98,
      "image": "https://...",
      "vendor": "Sport Store"
    }
  ],
  "meta": {
    "item_count": 1,
    "subtotal": 99.98,
    "currency": "EUR"
  }
}
POST /api/v1/cart user token

Add an item to cart. Quantity is automatically capped at available stock.

FieldTypeDescription
product_id *integerProduct ID
variant_idintegerVariant ID (if applicable)
quantityinteger1โ€“100 (default: 1)
curl -X POST "https://nofert.net/api/v1/cart" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "product_id=42" -d "quantity=2"
PATCH /api/v1/cart/{key} user token

Update item quantity. Key format: productId:variantId.

curl -X PATCH "https://nofert.net/api/v1/cart/42:0" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "quantity=3"
DELETE /api/v1/cart/{key} user token

Remove a single item from cart.

curl -X DELETE "https://nofert.net/api/v1/cart/42:0" \
  -H "Authorization: Bearer nofert_u_..."
DELETE /api/v1/cart user token

Clear the entire cart.

curl -X DELETE "https://nofert.net/api/v1/cart" \
  -H "Authorization: Bearer nofert_u_..."

๐Ÿ’œ Wishlist

GET /api/v1/user/wishlist user token

List all products in the user's wishlist with details and pagination.

curl "https://nofert.net/api/v1/user/wishlist" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/wishlist user token

Add a product to wishlist. Adding a product that's already in the wishlist returns 200 (no duplicates).

curl -X POST "https://nofert.net/api/v1/user/wishlist" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "product_id=42"
DELETE /api/v1/user/wishlist/{productId} user token

Remove a product from wishlist.

curl -X DELETE "https://nofert.net/api/v1/user/wishlist/42" \
  -H "Authorization: Bearer nofert_u_..."

๐Ÿ“ Saved Addresses

GET /api/v1/user/addresses user token

List all saved addresses. Default address appears first.

curl "https://nofert.net/api/v1/user/addresses" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/addresses user token

Create a new saved address. Setting is_default: true will unset any existing default.

FieldTypeDescription
labelstringLabel (e.g. "Home", "Office")
name *stringRecipient name
phone *stringPhone number
address *stringStreet address
city *stringCity
statestringState / province
zipstringZIP / postal code
country *stringCountry
is_defaultbooleanSet as default address
curl -X POST "https://nofert.net/api/v1/user/addresses" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "label=Home" -d "name=Jane Doe" -d "phone=+38349123456" \
  -d "address=Rr. UCK nr 5" -d "city=Pristina" -d "country=Kosovo" \
  -d "is_default=1"
PUT /api/v1/user/addresses/{id} user token

Update an existing address. Send only the fields you want to change.

curl -X PUT "https://nofert.net/api/v1/user/addresses/1" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "city=Deqan" -d "zip=30000"
DELETE /api/v1/user/addresses/{id} user token

Delete a saved address.

curl -X DELETE "https://nofert.net/api/v1/user/addresses/1" \
  -H "Authorization: Bearer nofert_u_..."

๐Ÿ”” Notifications

GET /api/v1/user/notifications user token

List notifications with unread count in meta. Paginated.

curl "https://nofert.net/api/v1/user/notifications" \
  -H "Authorization: Bearer nofert_u_..."

# Response meta includes: "unread_count": 3
POST /api/v1/user/notifications/{id}/read user token

Mark a single notification as read.

curl -X POST "https://nofert.net/api/v1/user/notifications/abc-123/read" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/notifications/read-all user token

Mark all notifications as read at once.

curl -X POST "https://nofert.net/api/v1/user/notifications/read-all" \
  -H "Authorization: Bearer nofert_u_..."

๐Ÿ’ณ Checkout & Payments

Mobile-native checkout flow. Create an order and receive a Stripe client_secret or PayPal approval_url for native SDK payment.

POST /api/v1/checkout user token

Create an order from the user's cart. Returns payment details for the native SDK to complete.

FieldTypeDescription
payment_method *enumstripe ยท paypal ยท cod
shipping_address_id *integerID of a saved address
shipping_methodstringShipping method code (from shipping-rates)
notesstringOrder notes (max 1000 chars)

Request

curl -X POST "https://nofert.net/api/v1/checkout" \
  -H "Authorization: Bearer nofert_u_..." \
  -H "Content-Type: application/json" \
  -d '{
    "payment_method": "stripe",
    "shipping_address_id": 1
  }'

Response (Stripe)

{
  "order_number": "ORD-20260225-XK42",
  "payment_method": "stripe",
  "client_secret": "pi_3abc_secret_xyz",
  "total": 99.98,
  "currency": "eur"
}
POST /api/v1/checkout/shipping-rates user token

Get available shipping methods and costs for the user's cart and address.

FieldTypeDescription
shipping_address_id *integerID of a saved address
curl -X POST "https://nofert.net/api/v1/checkout/shipping-rates" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "shipping_address_id=1"
POST /api/v1/payment/stripe/confirm user token

Confirm a Stripe payment after the native SDK completes. Call this after confirmPayment() succeeds in the Stripe mobile SDK.

FieldTypeDescription
payment_intent_id *stringStripe PaymentIntent ID (e.g. pi_3abc123)
curl -X POST "https://nofert.net/api/v1/payment/stripe/confirm" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "payment_intent_id=pi_3abc123"
POST /api/v1/payment/paypal/confirm user token

Confirm a PayPal payment after the user approves. Call this after the PayPal SDK flow completes.

FieldTypeDescription
paypal_order_id *stringPayPal order ID from the approval flow
curl -X POST "https://nofert.net/api/v1/payment/paypal/confirm" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "paypal_order_id=4MW805572N795704B"

๐Ÿ“ฒ Push Tokens

Register FCM (Android) or APNS (iOS) push notification tokens. Tokens are stored per-user and used for order updates, promotions, and messages.

GET /api/v1/user/push-tokens user token

List all registered push tokens for the authenticated user.

curl "https://nofert.net/api/v1/user/push-tokens" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/push-tokens user token

Register a new push token. If the token already exists, it updates the platform/device info.

FieldTypeDescription
token *stringFCM or APNS token
platform *enumios ยท android ยท web
device_namestringDevice label (e.g. "iPhone 15")
curl -X POST "https://nofert.net/api/v1/user/push-tokens" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "token=fcm_abc123..." -d "platform=android" -d "device_name=Pixel 8"
DELETE /api/v1/user/push-tokens/{token} user token

Unregister a push token (e.g. on logout or app uninstall).

curl -X DELETE "https://nofert.net/api/v1/user/push-tokens/fcm_abc123" \
  -H "Authorization: Bearer nofert_u_..."

โš™๏ธ User Preferences

Manage notification preferences and language settings. Stored server-side with 1-year cache.

GET /api/v1/user/preferences user token

Get the user's current preferences. Returns defaults if none have been set.

Request

curl "https://nofert.net/api/v1/user/preferences" \
  -H "Authorization: Bearer nofert_u_..."

Response

{
  "push_orders": true,
  "push_promotions": true,
  "push_messages": true,
  "email_orders": true,
  "email_promotions": false,
  "language": "en"
}
PUT /api/v1/user/preferences user token

Update preferences. Only send the fields you want to change.

FieldTypeDescription
push_ordersbooleanPush notifications for order updates
push_promotionsbooleanPush notifications for promotions
push_messagesbooleanPush notifications for messages
email_ordersbooleanEmail notifications for orders
email_promotionsbooleanEmail notifications for promotions
languageenumen ยท es ยท mk ยท sq
curl -X PUT "https://nofert.net/api/v1/user/preferences" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "push_promotions=false" -d "language=sq"

โ†ฉ๏ธ Returns

GET /api/v1/user/returns user token

List the user's return requests with order details and status.

ParameterTypeDescription
per_pageinteger1โ€“50 (default: 15)

Request

curl "https://nofert.net/api/v1/user/returns" \
  -H "Authorization: Bearer nofert_u_..."

Response

{
  "data": [
    {
      "id": 1,
      "order_number": "ORD-20260219-XK42",
      "reason": "Item arrived damaged",
      "status": "pending",
      "created_at": "2026-02-20T10:00:00Z"
    }
  ],
  "meta": {
    "current_page": 1,
    "total": 2
  }
}

๐ŸŽซ Support Tickets

GET /api/v1/user/tickets user token

List the user's support tickets. Filterable by status.

curl "https://nofert.net/api/v1/user/tickets?status=open" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/tickets user token 5 req/min

Create a support ticket. Rate limited to 5 per minute.

FieldTypeDescription
subject *stringTicket subject (max 255)
message *stringTicket description (max 5000)
categoryenumorder_issue ยท payment ยท account ยท product ยท other
priorityenumlow ยท medium ยท high
curl -X POST "https://nofert.net/api/v1/user/tickets" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "subject=Order not received" \
  -d "message=My order ORD-123 has not arrived" \
  -d "category=order_issue" -d "priority=medium"
GET /api/v1/user/tickets/{id} user token

View ticket details including message and admin reply.

curl "https://nofert.net/api/v1/user/tickets/1" \
  -H "Authorization: Bearer nofert_u_..."
POST /api/v1/user/tickets/{id}/reply user token 10 req/min

Reply to a ticket. If the ticket was resolved, it will be re-opened. Closed tickets cannot be replied to.

curl -X POST "https://nofert.net/api/v1/user/tickets/1/reply" \
  -H "Authorization: Bearer nofert_u_..." \
  -d "message=Any update on this?"

โšก Webhooks

Receive real-time HTTP POST notifications when order events occur โ€” no polling required.

Register your endpoints from Vendor โ†’ Webhooks. You can register up to 5 URLs per account.

Available Events

EventWhen it firesKey data
order.created A new order is placed via the API order_number, total
order.paid Payment confirmed (Stripe, PayPal, etc.) order_number, transaction_ref
order.shipped Vendor marks the order as shipped tracking_number, tracking_carrier
order.delivered Order marked as delivered order_number, status

Payload Structure

Every webhook is a JSON POST. The outer wrapper is always the same; only data varies by event.

{
  "event": "order.paid",
  "timestamp": "2026-02-19T10:00:00.000000Z",
  "data": {
    "order_number": "ORD-20260219-XK42",
    "status": "processing",
    "payment_status": "paid",
    "total": 49.99,
    "currency": "EUR",
    "transaction_ref": "pi_3abc123",
    "tracking_number": null,
    "tracking_carrier": null
  }
}

Signature Verification

Every delivery includes an X-Nofert-Signature header โ€” an HMAC-SHA256 signature of the raw request body using your webhook secret. Always verify it before processing the event.

Your webhook secret is shown (masked) in Vendor โ†’ Webhooks. Copy it when you first create the webhook.

PHP

$signature = $_SERVER['HTTP_X_NOFERT_SIGNATURE'] ?? '';
$rawBody   = file_get_contents('php://input');
$expected  = 'sha256=' . hash_hmac('sha256', $rawBody, $yourSecret);

if (!hash_equals($expected, $signature)) {
    http_response_code(403);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
echo $event['event']; // "order.paid"

Node.js

const crypto = require('crypto');

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const sig      = req.headers['x-nofert-signature'];
  const expected = 'sha256=' + crypto
    .createHmac('sha256', process.env.WEBHOOK_SECRET)
    .update(req.body)
    .digest('hex');

  if (!crypto.timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) {
    return res.status(403).send('Invalid signature');
  }

  const event = JSON.parse(req.body);
  console.log(event.event); // "order.paid"
  res.sendStatus(200);
});

Python

import hmac, hashlib, json
from flask import request

@app.route('/webhook', methods=['POST'])
def webhook():
    sig      = request.headers.get('X-Nofert-Signature', '')
    expected = 'sha256=' + hmac.new(
        SECRET.encode(), request.data, hashlib.sha256
    ).hexdigest()

    if not hmac.compare_digest(sig, expected):
        return 'Invalid signature', 403

    event = json.loads(request.data)
    print(event['event'])  # "order.paid"
    return '', 200
Best practices: Return HTTP 2xx quickly โ€” ideally within 5 seconds. Queue heavy processing for after the response. Webhooks that fail 10 times in a row are automatically disabled.

๐Ÿ“Š Vendor: Dashboard

Access vendor dashboard stats including order counts, revenue, product stats, and recent orders. Requires user token auth (vendor role).

GET /api/v1/vendor/dashboard User Token

Returns dashboard overview: order counts by status, total revenue, product stats, and recent orders.

curl "https://nofert.net/api/v1/vendor/dashboard" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"

๐Ÿ“ฆ Vendor: Products

Full product management for vendors. Create, update, delete products and manage product images. Requires user token auth (vendor role).

GET /api/v1/vendor/products User Token

List all products belonging to the authenticated vendor. Supports pagination, search, and status filtering.

curl "https://nofert.net/api/v1/vendor/products?status=active&per_page=20" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/products User Token

Create a new product. Accepts name, description, price, category, stock, variants, and other product fields.

GET /api/v1/vendor/products/{id} User Token

Get full details of a single product owned by the vendor.

PUT /api/v1/vendor/products/{id} User Token

Update an existing product. All updatable fields accepted.

DELETE /api/v1/vendor/products/{id} User Token

Delete a product. Soft-deletes so order history is preserved.

POST /api/v1/vendor/products/{id}/images User Token

Upload images for a product. Accepts multipart file uploads.

DELETE /api/v1/vendor/products/{id}/images/{imageId} User Token

Delete a specific image from a product.

๐Ÿ“‹ Vendor: Orders

Manage orders received by the vendor. View order details, update statuses, and add tracking information. Requires user token auth (vendor role).

GET /api/v1/vendor/orders User Token

List all orders for the vendor. Supports filtering by status, date range, and pagination.

curl "https://nofert.net/api/v1/vendor/orders?status=processing&per_page=20" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
GET /api/v1/vendor/orders/{orderNumber} User Token

Get detailed order information including items, shipping address, and payment details.

PATCH /api/v1/vendor/orders/{orderNumber}/status User Token

Update order status. Valid transitions are enforced (e.g., processing โ†’ shipped โ†’ delivered).

POST /api/v1/vendor/orders/{orderNumber}/tracking User Token

Add or update tracking information (carrier, tracking number, tracking URL).

๐Ÿ’ฐ Vendor: Earnings & Payouts

View earnings summary and manage payout requests. COD orders are excluded from payout balance (vendor already received cash). Requires user token auth (vendor role).

GET /api/v1/vendor/earnings User Token

Returns earnings summary: total earnings, available balance, pending payouts, and recent transactions.

curl "https://nofert.net/api/v1/vendor/earnings" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
GET /api/v1/vendor/payouts User Token

List all payout requests with status (pending, approved, paid, rejected).

POST /api/v1/vendor/payouts User Token

Request a new payout. Specify amount and payout method. Subject to minimum payout threshold.

๐Ÿช Vendor: Profile

Manage the vendor shop profile including name, description, logo, banner, and vacation mode. Requires user token auth (vendor role).

GET /api/v1/vendor/profile User Token

Get the vendor's shop profile including shop name, description, logo, banner, and settings.

curl "https://nofert.net/api/v1/vendor/profile" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
PUT /api/v1/vendor/profile User Token

Update shop profile fields: name, description, logo, banner, social links, policies.

PATCH /api/v1/vendor/profile/vacation User Token

Toggle vacation mode on/off. When active, products are hidden from the storefront.

๐ŸŽŸ๏ธ Vendor: Coupons

Full CRUD for vendor-scoped discount coupons. Supports percentage and fixed discounts with usage limits. Requires user token auth (vendor role).

GET /api/v1/vendor/coupons User Token

List all coupons created by the vendor with usage stats.

curl "https://nofert.net/api/v1/vendor/coupons" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/coupons User Token

Create a new coupon. Fields: code, type (percentage/fixed), value, min_order, max_uses, expires_at.

GET /api/v1/vendor/coupons/{id} User Token

Get details of a specific coupon including usage history.

PUT /api/v1/vendor/coupons/{id} User Token

Update an existing coupon's settings.

DELETE /api/v1/vendor/coupons/{id} User Token

Delete a coupon. Active coupons in use will be invalidated.

โ“ Vendor: Questions

View and answer product questions from buyers. Requires user token auth (vendor role).

GET /api/v1/vendor/questions User Token

List all questions on the vendor's products. Filter by answered/unanswered status.

curl "https://nofert.net/api/v1/vendor/questions?status=unanswered" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/questions/{id}/answer User Token

Post an answer to a buyer's question. The answer will be visible on the product page.

โญ Vendor: Reviews

View reviews on vendor products and post replies. Requires user token auth (vendor role).

GET /api/v1/vendor/reviews User Token

List all reviews on the vendor's products. Supports filtering by rating and reply status.

curl "https://nofert.net/api/v1/vendor/reviews?per_page=20" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/reviews/{id}/reply User Token

Post a reply to a buyer's review. One reply per review.

๐Ÿ”„ Vendor: Returns

Manage return requests from buyers. Approve or reject returns with reason. Requires user token auth (vendor role).

GET /api/v1/vendor/returns User Token

List all return requests for the vendor's orders. Supports status filtering.

curl "https://nofert.net/api/v1/vendor/returns?status=pending" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
GET /api/v1/vendor/returns/{id} User Token

Get detailed return request information including photos and buyer reason.

PATCH /api/v1/vendor/returns/{id}/approve User Token

Approve a return request. Triggers refund processing.

PATCH /api/v1/vendor/returns/{id}/reject User Token

Reject a return request with a reason.

๐Ÿšš Vendor: Shipping

Manage shipping zones and rates. Each zone can have multiple rate tiers based on weight or order total. Requires user token auth (vendor role).

GET /api/v1/vendor/shipping/zones User Token

List all shipping zones with their rates.

curl "https://nofert.net/api/v1/vendor/shipping/zones" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/shipping/zones User Token

Create a new shipping zone with name and country list.

PUT /api/v1/vendor/shipping/zones/{id} User Token

Update a shipping zone.

DELETE /api/v1/vendor/shipping/zones/{id} User Token

Delete a shipping zone and all its rates.

POST /api/v1/vendor/shipping/zones/{id}/rates User Token

Add a shipping rate to a zone (flat, weight-based, or order-total-based).

PUT /api/v1/vendor/shipping/zones/{zoneId}/rates/{rateId} User Token

Update a shipping rate.

DELETE /api/v1/vendor/shipping/zones/{zoneId}/rates/{rateId} User Token

Delete a shipping rate from a zone.

๐Ÿ’ณ Vendor: Wallet

View vendor wallet balance and top up funds. Requires user token auth (vendor role).

GET /api/v1/vendor/wallet/balance User Token

Returns wallet balance and recent transaction history.

curl "https://nofert.net/api/v1/vendor/wallet/balance" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/wallet/topup User Token

Top up wallet via Stripe payment. Returns a Stripe client_secret for native SDK flow.

๐Ÿš€ Vendor: Onboarding

Multi-step vendor onboarding wizard. Track completion status and submit each step. Requires user token auth (vendor role).

GET /api/v1/vendor/onboarding/status User Token

Returns onboarding progress: completed steps, current step, and remaining requirements.

curl "https://nofert.net/api/v1/vendor/onboarding/status" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/onboarding/step/1 User Token

Submit Step 1: Shop information (name, description, category).

POST /api/v1/vendor/onboarding/step/2 User Token

Submit Step 2: Business details (address, tax ID, phone).

POST /api/v1/vendor/onboarding/step/3 User Token

Submit Step 3: Payment setup (bank account or Stripe Connect).

POST /api/v1/vendor/onboarding/step/4 User Token

Submit Step 4: Verification documents upload and agreement acceptance.

โœˆ๏ธ Vendor: Dropshipping

AliExpress dropshipping integration. Search products, preview details, import to your store, and sync inventory. Requires user token auth (vendor role).

GET /api/v1/vendor/dropshipping/dashboard User Token

Returns dropshipping dashboard: imported product count, sync status, and recent activity.

curl "https://nofert.net/api/v1/vendor/dropshipping/dashboard" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
GET /api/v1/vendor/dropshipping/search User Token

Search AliExpress products by keyword, category, or price range.

GET /api/v1/vendor/dropshipping/preview/{aliexpressId} User Token

Preview full product details before importing (title, images, variants, pricing).

POST /api/v1/vendor/dropshipping/import User Token

Import an AliExpress product to your store with optional price markup and category mapping.

POST /api/v1/vendor/dropshipping/sync User Token

Trigger inventory and price sync for all imported dropshipping products.

GET /api/v1/vendor/dropshipping/api-settings User Token

View and manage AliExpress API credentials and sync settings.

PUT /api/v1/vendor/dropshipping/api-settings User Token

Update AliExpress API credentials and sync preferences.

๐Ÿ“š Vendor: Supplier Catalog

Browse the internal supplier catalog and import products directly to your store. Requires user token auth (vendor role).

GET /api/v1/vendor/supplier-catalog User Token

Browse available supplier products with search, category filtering, and pagination.

curl "https://nofert.net/api/v1/vendor/supplier-catalog?search=headphones&per_page=20" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
GET /api/v1/vendor/supplier-catalog/{id} User Token

Get full details of a supplier product including variants, images, and wholesale pricing.

POST /api/v1/vendor/supplier-catalog/{id}/import User Token

Import a supplier product to your store with custom pricing and category.

๐Ÿ“ค Vendor: Bulk Import

Import products in bulk via CSV file. Download the template, fill in your products, and upload. Requires user token auth (vendor role).

GET /api/v1/vendor/import/template User Token

Download the CSV template with headers and example rows.

curl "https://nofert.net/api/v1/vendor/import/template" \
  -H "Authorization: Bearer YOUR_USER_TOKEN" \
  -o products-template.csv
POST /api/v1/vendor/import/upload User Token

Upload a CSV file to import products. Returns import job status with success/error counts.

๐Ÿ”‘ Vendor: API Keys

Manage vendor API keys programmatically. Requires user token auth (vendor role).

GET /api/v1/vendor/api-keys User Token

List all API keys for the vendor with last-used timestamps and permissions.

curl "https://nofert.net/api/v1/vendor/api-keys" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/api-keys User Token

Create a new API key. The key value is returned only once โ€” store it securely.

PATCH /api/v1/vendor/api-keys/{id}/toggle User Token

Enable or disable an API key.

DELETE /api/v1/vendor/api-keys/{id} User Token

Permanently revoke and delete an API key.

๐Ÿ”” Vendor: Webhooks

Manage webhook endpoints programmatically. Create, test, enable/disable, and delete webhook URLs. Requires user token auth (vendor role).

GET /api/v1/vendor/webhooks User Token

List all registered webhook endpoints with delivery stats.

curl "https://nofert.net/api/v1/vendor/webhooks" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/webhooks User Token

Register a new webhook URL with event subscriptions. Returns the webhook secret.

PATCH /api/v1/vendor/webhooks/{id}/toggle User Token

Enable or disable a webhook endpoint.

POST /api/v1/vendor/webhooks/{id}/test User Token

Send a test payload to the webhook URL to verify it's working.

DELETE /api/v1/vendor/webhooks/{id} User Token

Delete a webhook endpoint. All pending deliveries will be cancelled.

๐ŸŒ Vendor: Domains

Manage custom domain and subdomain for the vendor storefront. Requires user token auth (vendor role).

GET /api/v1/vendor/domains/status User Token

Returns current domain configuration: subdomain, custom domain, SSL status, and DNS verification.

curl "https://nofert.net/api/v1/vendor/domains/status" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
PUT /api/v1/vendor/domains/subdomain User Token

Set or change the vendor's subdomain (e.g., myshop.nofert.net).

PUT /api/v1/vendor/domains/custom User Token

Set a custom domain (e.g., shop.example.com). Returns DNS records to configure.

POST /api/v1/vendor/domains/verify User Token

Trigger DNS verification for the custom domain.

DELETE /api/v1/vendor/domains/custom User Token

Remove the custom domain and revert to subdomain only.

โœ… Vendor: Verification

Vendor identity verification process. Submit documents and track verification status. Requires user token auth (vendor role).

GET /api/v1/vendor/verification/status User Token

Returns current verification status: unverified, pending, verified, or rejected with reason.

curl "https://nofert.net/api/v1/vendor/verification/status" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/verification/submit User Token

Submit verification documents (ID, business registration). Accepts multipart file uploads.

๐Ÿ’ณ Vendor: Stripe Connect

Manage Stripe Connect onboarding for direct payouts. Requires user token auth (vendor role).

GET /api/v1/vendor/stripe-connect/status User Token

Returns Stripe Connect account status: not_connected, pending, active, or restricted.

curl "https://nofert.net/api/v1/vendor/stripe-connect/status" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/vendor/stripe-connect/connect User Token

Initiate Stripe Connect onboarding. Returns an onboarding URL to redirect the vendor to.

GET /api/v1/vendor/stripe-connect/dashboard User Token

Get a Stripe Express Dashboard login link for the vendor to manage their payout settings.

๐Ÿ“„ Vendor: Order Documents

Generate invoices and shipping labels for orders. Requires user token auth (vendor role).

GET /api/v1/vendor/orders/{orderNumber}/invoice User Token

Generate and download a PDF invoice for the order.

curl "https://nofert.net/api/v1/vendor/orders/ORD-20260301-XK42/invoice" \
  -H "Authorization: Bearer YOUR_USER_TOKEN" \
  -o invoice.pdf
GET /api/v1/vendor/orders/{orderNumber}/shipping-label User Token

Generate and download a shipping label PDF for the order.

๐Ÿค Affiliate

Join the affiliate program, generate referral links, and track commissions. Requires user token auth.

GET /api/v1/user/affiliate/status User Token

Returns affiliate status: active, pending, or not_enrolled. Includes commission rate and total earned.

curl "https://nofert.net/api/v1/user/affiliate/status" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/user/affiliate/apply User Token

Apply to join the affiliate program.

POST /api/v1/user/affiliate/generate-link User Token

Generate a referral link for a specific product or the homepage.

GET /api/v1/user/affiliate/commissions User Token

List commission history with status (pending, approved, paid) and pagination.

๐Ÿ” Two-Factor Auth Management

Enable, confirm, and disable TOTP-based two-factor authentication. Requires user token auth.

GET /api/v1/user/2fa/status User Token

Returns whether 2FA is enabled, pending confirmation, or disabled for the user.

curl "https://nofert.net/api/v1/user/2fa/status" \
  -H "Authorization: Bearer YOUR_USER_TOKEN"
POST /api/v1/user/2fa/enable User Token

Start 2FA setup. Returns a TOTP secret and QR code URL for the authenticator app.

POST /api/v1/user/2fa/confirm User Token

Confirm 2FA setup by providing a valid TOTP code from the authenticator app. Returns recovery codes.

POST /api/v1/user/2fa/disable User Token

Disable 2FA. Requires current password for security.

๐Ÿšฉ Reports

Report products or vendors for policy violations. Requires user token auth.

POST /api/v1/products/{id}/report User Token

Report a product for policy violation. Provide a reason (counterfeit, inappropriate, spam, other) and optional details.

curl -X POST "https://nofert.net/api/v1/products/42/report" \
  -H "Authorization: Bearer YOUR_USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "reason": "counterfeit", "details": "This appears to be a fake product." }'
POST /api/v1/vendors/{id}/report User Token

Report a vendor for policy violation. Same reason/details fields as product reports.

๐Ÿ‘ Review Voting

Vote on reviews as helpful or unhelpful. One vote per review per user. Requires user token auth.

POST /api/v1/reviews/{id}/vote User Token

Vote on a review. Send vote: "helpful" or vote: "unhelpful". Voting again with the same value removes the vote (toggle).

curl -X POST "https://nofert.net/api/v1/reviews/15/vote" \
  -H "Authorization: Bearer YOUR_USER_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{ "vote": "helpful" }'

๐Ÿ“ง Newsletter

Subscribe to the marketplace newsletter. Public endpoint, no authentication required.

POST /api/v1/newsletter/subscribe public

Subscribe an email address to the newsletter. Rate limited to prevent abuse.

curl -X POST "https://nofert.net/api/v1/newsletter/subscribe" \
  -H "Content-Type: application/json" \
  -d '{ "email": "user@example.com" }'