REST API

Build on the API
the app runs on.

Products, families, attributes, categories and assets over REST, described in an OpenAPI reference and checked against the same permissions as your team.

Book a demo See the API

Request

GET /api/products?language=en&search=DEMO-SEN-009

Cookie__Secure-openprod.session_token=••••••••

Response application/json 200 OK

{"items": [{"id": "2f900851-7d30-54b5-8a91-741507387b87","name": "M12 inductive sensor NPN","sku": "DEMO-SEN-009","mainImage": {…},"family": {"id": "1340643a-ad03-454a-81c3-676d1bca2e2a","name": "Inductive sensors","code": "demo_sensors","inheritance": "variant"},"variantsCount": 0,"createdAt": "2026-09-28T17:27:54.912Z","updatedAt": "2026-09-30T21:36:14.480Z"}],"total": 1,"page": 1,"pageSize": 20}

01Resources

The whole catalogue, over one REST API.

Read and write products, variants, families, attributes, categories, data languages and assets. A value saved through the API is the value your team sees in the app.

Products M12 inductive sensor PNP

M12 inductive sensor PNP Inductive sensorsSKU: DEMO-SEN-001

English (default)

Product DataRelationsCategories

Technical specifications 8/8

Switching output

PNP normally open

Weight

90 Gram

products Update product edit values

PUT /api/products/b567aa56-30c1-4eb5-9411-035ad614574d/values

Bodyapplication/json

{"language": "en","values": [{"attributeId": "857a85dc-356e-4d83-bf31-7f66494b97c1","value": {"value": 90,"unit": "demo_g"}}]}

Send

Response application/json 200 OK

The product with its saved values, as the app reads it.

The same product as in the app The new weight shows on the product page and adds a version to its history.

GET /api/products/{id}/variants

Products and variants

List, search and filter products, read one in any data language and create variants.

PUT /api/families/{id}/structure

The data model

Families and their structure, attributes, attribute groups, units, dictionaries and data languages.

PUT /api/products/{id}/categories

Category trees

Build category trees and set the categories of each product.

POST /api/assets/upload-from-url

Assets

Upload files or fetch them from a URL, organise folders and read thumbnails.

02Reference

An OpenAPI reference inside your openProd.

Every route is described from the same schemas that check its requests. It opens at /api/docs for the roles you allow.

/api/docs

openProd.io API 0.0.0 OAS 3.0.3

REST API for the openProd.io admin panel.

products

GET /api/products List products

GET /api/products/{id} Get product edit detail

Parameters

id^* string($uuid) (path)

language^* string (query)

Responses

200 400 404

PUT /api/products/{id}/values Update product edit values

POST /api/products Create a product

Open for the roles you choose The reference opens for users whose role includes Read API docs.

OpenAPI 3.0.3

Built from the schemas

Parameters and responses come from the schemas that validate each request, so the reference matches the API.

/api/docs/json /api/docs/yaml

JSON and YAML

Take the specification from /api/docs/json or /api/docs/yaml into your own tools.

400 {"error": "validation"}

Errors you can read

A rejected request returns 400 with the fields that failed, 404 for a missing record and 409 for a conflict.

products families assets

Grouped by resource

Routes are grouped the way the app is: products, families, attributes, categories, assets and more.

03Access

Your team's roles, on every request.

The API works with a signed-in openProd user. Each route checks one permission of that user's roles, and every change is saved under their name.

Roles Edit role

Name Product editor Permissions

API documentation

Read API docs

Products

Read products Create products Update product values Create product variants Update product variants Delete products Read product history Restore product history Read product canvas Update product canvas Export product canvas

Requests

POST /api/auth/sign-in/email 200 Set-Cookie: __Secure-openprod.session_token=••••••••

GET /api/products?language=en&search=DEMO-SEN-001 200

PUT /api/products/b567aa56-30c1-4eb5-9411-035ad614574d/values 200

DELETE /api/products/b567aa56-30c1-4eb5-9411-035ad614574d 403

{"error": "forbidden"}

Checked on every route The role can read and update products, so the delete is refused with 403.

POST /api/auth/sign-in/email

Sign in once

Sign in with the user's email and password and send the session cookie with the calls that follow.

products.values.update Update product values

One permission per route

Reading products needs Read products. Saving values needs Update product values.

401 unauthorized 403 forbidden

Clear refusals

A call without a session returns 401. A call the role does not allow returns 403.

Source API Actor Jan Testowy

On the record

Changes show source API and the user in the audit log, and product edits add a version to the history.

04MCP server

For AI agents, the MCP server.

A separate MCP server gives AI clients tools for products, families, attributes, categories and assets, protected by its own key and the origins you allow.

AI client Connected servers openprod-pim

TransportStreamable HTTP

Endpoint/mcp

AuthorizationBearer ••••••••

Products

searchProductslookupProductsBySkugetProductDetailsupdateProductValuescreateProductVariant

Before you
write the first call.

How do API calls authenticate?

With an openProd user session. Sign in with the user's email and password at POST /api/auth/sign-in/email and send the session cookie with the calls that follow. Each route then checks the permissions of that user's roles.

Can I use API keys or access tokens?

The REST API works with user sessions. The MCP server has its own key, sent as a bearer token. If your integration needs another way to connect, talk to the team.

Where do I find the API reference?

In your openProd at /api/docs, for users whose role includes Read API docs. The same specification is available as JSON at /api/docs/json and as YAML at /api/docs/yaml.

Which permissions does an integration need?

Only the ones for the routes it calls. Create a role for the integration, for example with Read products and Update product values, and give it to the user the integration signs in as.

Are changes made through the API recorded?

Yes. They appear in the audit log with source API and the signed-in user as actor. Product edits also add a version to the product history, like edits in the app.

Does openProd send webhooks?

Not today. If your integration needs to react to changes in openProd, talk to the team about your case.

Is there an SDK?

There is no official SDK. The OpenAPI specification describes every route, so you can generate a client for your language with standard OpenAPI tools.

How is the MCP server different from the REST API?

The MCP server is a separate service for AI clients. It offers tools instead of routes, is protected by its own key and allowed origins instead of user roles, and its changes appear in the audit log with source MCP.

Build on the APIthe app runs on.