RED Developers
Authentication

Vendor API keys with scoped access and one-time secret display.

Webhook Events

Outbound webhook payload format for operational alerting.

Developer Documentation

RED: The Order Engine exposes vendor integrations for dispensary operations automation. Integrations typically read catalog data, act on purchase order workflows, analyze velocity for operational visibility, and consume webhook signals for operational alerts.

The platform surfaces operational signals so vendors can automate fulfillment and order workflows.

Who this is for

These developer interfaces are designed for vendor-side systems, fulfillment automation, reporting pipelines, and AI agents that integrate with purchase order and inventory workflows.

Integration model

APIs expose current system state and write operations; webhooks deliver asynchronous operational signals.

  1. Authenticate using a scoped vendor API key.
  2. Read catalog and velocity context.
  3. Retrieve or act on purchase orders.
  4. Use velocity analytics for read-only reporting.
  5. Treat planning recommendations as internal OrderEngine snapshots approved by store teams.
  6. Subscribe to webhook events for operational alerts and inventory signals.

Core concepts

  • Catalog Product: vendor catalog item mapped to platform products.
  • Purchase Order: vendor order workflow including revisions and delivery planning.
  • Velocity: aggregated sales velocity for operational visibility.
  • Webhook Event: outbound operational signal emitted by the engine.
External API Reference

Endpoint contracts for catalog, purchase orders, velocity analytics, and retry/idempotency guidance.

Open API docs
Webhook Reference

Operational events including inventory alerts and vendor API observability signals, with delivery semantics and payload schemas.

Open webhook docs

Quickstart

  1. Generate a vendor API key in Console → Vendors → API Keys.
  2. Assign only the scopes required by the integration.
  3. Call /api/external/v1/* using Authorization: Bearer vek_<prefix>_<secret>.
  4. Send Idempotency-Key for write operations to make retries safe.
  5. Configure webhook endpoints to receive operational events.

Security defaults

  • Keys are stored hashed-at-rest and plaintext is only shown once.
  • Vendor key format is vek_<prefix>_<secret>.
  • Scopes are allowlisted and enforced per endpoint.
  • Revoked or expired keys are denied immediately.
  • External writes support idempotent replay safety.