Guides
OpenAPI contract
The machine-readable OpenAPI 3.1 contract for the public API.
The public API is described by a machine-readable OpenAPI 3.1 document, so you can generate clients, import it into API tools, or validate your integration.
Download: openapi.json
What it covers
- Every endpoint under the public API, with its method, path, parameters, request body and responses.
- Bearer-key security for every endpoint except the public catalog.
- Extension fields that state the access rules for each operation:
| Extension | Meaning |
|---|---|
x-required-scope | The key scope the operation needs (absent when any valid key is enough). |
x-required-permissions | The role permissions the key's role must hold. |
x-requires-app | The purchased application the operation needs, where one is required. |
x-idempotency | required for POST, optional for PATCH. |
Server URL
The document uses a server variable apiHost. Replace it with the API host given to you with your Developer API access. The path prefix is /api/public/v1.
Staying accurate
The document is checked automatically against the real API routes, scopes, permissions, idempotency rules and request fields, so it cannot silently drift from what the API actually does. Only the public API is described: internal NEXTOREx product routes are not part of it and are not supported for integrations.
Versioning
The path prefix is the version (/v1). Within a version NEXTOREx adds fields and optional parameters without notice; your client should ignore fields it does not know. Removing or changing existing behaviour requires a new version.