DashboardDeveloper Portal

API Reference

Base URL: https://api.useflyconnect.com · All endpoints require Authorization: Bearer <token>

Authentication

Fly supports Bearer JWT (via /api/v1/auth/login) for first-party integrations and OAuth 2.0 (Authorization Code) for partner apps. OAuth-token access to the business APIs below is in private beta — the token endpoints work today, but API services are still being upgraded to accept OAuth access tokens. Email developers@useflysystems.com to enrol.

Authorization header

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...
POST/api/v1/auth/loginExchange credentials for a JWT access token and refresh token
POST/api/v1/auth/refreshObtain a new access token using a refresh token
POST/api/v1/auth/logoutRevoke the current session tokens
GET/api/v1/auth/meReturn the authenticated user profile
POST/api/v1/oauth/tokenOAuth 2.0 token exchange (authorization_code / refresh_token / client_credentials)
POST/api/v1/oauth/revokeRevoke an OAuth access or refresh token (RFC 7009)
POST/api/v1/oauth/introspectInspect an OAuth access token (RFC 7662)

POST /api/v1/auth/login — Request

{
  "email": "admin@store.com",
  "password": "••••••••"
}

Response 200

{
  "data": {
    "accessToken": "eyJhbGci...",
    "refreshToken": "eyJhbGci...",
    "expiresIn": 900,
    "user": { "id": "uuid", "email": "admin@store.com", "orgId": "uuid" }
  }
}

Catalog

GET
/api/v1/catalog/products

List products for the authenticated org with pagination

POST
/api/v1/catalog/products

Create a new product

GET
/api/v1/catalog/products/:id

Retrieve a single product by ID

PATCH
/api/v1/catalog/products/:id

Update product fields

DELETE
/api/v1/catalog/products/:id

Archive (soft-delete) a product

GET
/api/v1/catalog/categories

List product categories

POST
/api/v1/catalog/categories

Create a category

GET
/api/v1/catalog/modifiers/groups

List modifier groups and options

GET
/api/v1/catalog/price-lists

List price lists

POST
/api/v1/catalog/price-lists

Create a price list

Inventory

GET
/api/v1/inventory/stock

Get stock levels, filterable by location and product

GET
/api/v1/inventory/stock/low-stock

List items at or below their reorder point

POST
/api/v1/inventory/stock/adjust

Manual stock adjustment with reason code

GET
/api/v1/inventory/transfers

List inter-location stock transfers

POST
/api/v1/inventory/transfers

Create an inter-location stock transfer

GET
/api/v1/inventory/transfers/:id

Retrieve a single transfer with line items

Orders

GET
/api/v1/orders

List orders with filters (status, date range, location)

POST
/api/v1/orders

Create a new order

GET
/api/v1/orders/:id

Retrieve order with line items, payments, and history

PATCH
/api/v1/orders/:id

Update order fields (including status)

POST
/api/v1/orders/:id/complete

Mark an order as completed

POST
/api/v1/orders/:id/refund

Initiate a full or partial refund

Payments

GET
/api/v1/payments

List payment records for the org

POST
/api/v1/payments/initiate

Initiate a payment for an order

POST
/api/v1/payments/:id/void

Void a payment

GET
/api/v1/payments/settlements

List settlement summaries

Customers

GET
/api/v1/customers

Search and list customers

POST
/api/v1/customers

Create a customer record

GET
/api/v1/customers/:id

Get a customer profile

PATCH
/api/v1/customers/:id

Update customer fields and preferences

DELETE
/api/v1/customers/:id

Delete a customer record

Loyalty

GET
/api/v1/loyalty/programs

List loyalty programs for the org

POST
/api/v1/loyalty/programs

Create a loyalty program

POST
/api/v1/loyalty/accounts

Enrol a customer into a loyalty account

GET
/api/v1/loyalty/accounts/customer/:customerId

Get the loyalty account for a customer

POST
/api/v1/loyalty/accounts/:accountId/earn

Accrue points on an account

POST
/api/v1/loyalty/accounts/:accountId/redeem

Redeem points from an account

GET
/api/v1/loyalty/accounts/:accountId/transactions

List points transactions for an account

Campaigns

GET
/api/v1/campaigns

List marketing campaigns

POST
/api/v1/campaigns

Create a campaign (discount, offer, promotion)

GET
/api/v1/campaigns/:id

Retrieve a single campaign

PATCH
/api/v1/campaigns/:id

Update campaign status or rules

POST
/api/v1/campaigns/:id/launch

Launch a draft campaign

GET
/api/v1/campaigns/:id/analytics

Campaign performance metrics

Automations

GET
/api/v1/automations

List automation rules for the org

POST
/api/v1/automations

Create an automation rule (trigger + conditions + actions)

PATCH
/api/v1/automations/:id

Update automation rule

DELETE
/api/v1/automations/:id

Delete an automation rule

POST
/api/v1/automations/trigger

Manually fire a trigger event for testing

GET
/api/v1/automations/:id/executions

List execution history for a rule

Webhooks

GET
/api/v1/webhooks

List webhook endpoints for the org

POST
/api/v1/webhooks

Register a webhook endpoint (signing secret returned once)

GET
/api/v1/webhooks/:id

Retrieve a single webhook endpoint

PATCH
/api/v1/webhooks/:id

Update URL, subscribed events, or status

DELETE
/api/v1/webhooks/:id

Remove a webhook endpoint

POST
/api/v1/webhooks/:id/test

Send a signed test.ping delivery to the endpoint

GET
/api/v1/webhooks/:id/deliveries

List the last 50 delivery attempts

POST
/api/v1/webhooks/:id/rotate-secret

Rotate the HMAC signing secret (takes effect immediately)

Locations

GET
/api/v1/locations

List locations (sites/stores) for the org

Rate Limits

All API endpoints enforce per-org rate limits. The default ceiling is suitable for any merchant up to mid-volume; high-volume integrations can request a higher limit via support.

LimitValue
Requests / minute600
Burst900
Higher ceilingContact support

Rate limit headers: X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After

Error Codes (RFC 7807)

All errors follow the RFC 7807 Problem Details format:

{
  "type": "https://elevatedpos.com.au/errors/validation",
  "title": "Validation Error",
  "status": 422,
  "detail": "sku is required",
  "instance": "/api/v1/products"
}
400

Bad Request

Malformed request body or query parameters.

401

Unauthorized

Missing or invalid Bearer token.

403

Forbidden

Authenticated but insufficient scope or org mismatch.

404

Not Found

Resource does not exist or is outside your org.

422

Unprocessable Entity

Validation failed — see errors array for field details.

429

Too Many Requests

Rate limit exceeded. Retry after the Retry-After header value.

500

Internal Server Error

Unexpected server error. Contact support with the request ID.