LEGIT B2B · Developers

Partner REST API

Connect your web shop, ERP or marketplace listing to the LEGIT B2B catalogue: every product with your own net prices, live stock per warehouse, logistics and customs data, GPSR safety data, documents and images — as JSON, always current. Your API key is created by an approved business account under Account → Export → API— by the account owner or a login with full access (sub-accounts). Orders placed through the API belong to the whole company: every login of it sees them, and the API lists and cancels any of the company's orders.

Only able to import a file? See the XML feed documentation — and the step-by-step move from XML to the API below when you are ready.

Base URL and format

Base URL https://b2b.legit.si/api/v1. JSON in UTF-8: read the catalogue, place orders and follow them. Every response is { "data": …, "meta": … }.

Authentication

Create a key under Account → Export → API. It starts with lb2b_ and is shown once — we keep only a fingerprint. Send it on every call:

Authorization: Bearer lb2b_…        (or: X-Api-Key: lb2b_…)

Creating a new key disables the old one immediately; revoking leaves you without a key. Keys work only while your business account is approved. Keep the key on your server — never in a browser or an app.

When you create a key you choose what it may do: Full access (catalogue, stock, placing and cancelling orders) or Read only (catalogue, stock and reading orders — placing or cancelling answers 403 READ_ONLY_KEY). A stock / price sync needs only a read-only key.

Endpoints

curl -H "Authorization: Bearer lb2b_…" "https://b2b.legit.si/api/v1/products?lang=en&page=1&limit=100"

{ "data": [ { "ean": "0650311612944", "price": 18, "currency": "EUR",
             "inStock": true, "stock": 41, "warehouses": [ { "name": "Ljubljana (B13)", "stock": 41 } ],
             "deliveryDays": 1, "incoming": { "date": "2026-12-15", "quantity": 50, "more": true } } ],
  "meta": { "totalItems": 482, "generatedAt": "2026-10-15T12:00:00.000Z" } }

The product object

Product changes

What changed in the catalogue, field by field — names, descriptions, every specification attribute, images, documents, logistics and customs data, GPSR data, categories, brand, RRP, delivery days; new and removed products. (Prices and stock change all the time and have their own feed: /stock and the products.changed webhook.) We compare the catalogue every 12 hours and keep the log for 90 days. Several edits of a product between two checks arrive as one entry — from how it was at the previous check to how it is now.

{ "data": [ {
    "id": 128, "at": "2026-10-17T17:41:33.282Z",
    "ean": "0650311612944", "productId": "216", "name": "3D naslonjala za roke",
    "change": "updated",                         // added | updated | removed
    "changes": [
      { "field": "name.sl", "before": "3D naslonjala", "after": "3D naslonjala za roke" },
      { "field": "description.sl", "added": ["Barva: modra"], "removed": ["Barva: črna"] },
      { "field": "specifications.sl["Tehnične informacije / Teža"]", "before": "2 kg", "after": "2,4 kg" },
      { "field": "images", "added": ["https://…/new.jpg"], "removed": [] },
      { "field": "logistics.customsTariff", "before": null, "after": "94039100" }
    ] } ],
  "meta": { "limit": 100, "hasMore": false, "nextAfter": 128 } }

• Short values come as before / after; lists (images, documents, categories) and descriptions as added / removed — a description is compared line by line as plain text, so you see exactly the sentence that was deleted or added.
• A specification attribute is named specifications.<lang>["<group> / <name>"]; before: null = a new attribute, after: null = a removed one.
• added products carry no field list — fetch them with /products/{ean}. removed = we no longer sell it to you.
• Or let us push them: the catalog.updated webhook sends the same entries as they happen.

Orders

An order through the API is the same as an order on the web shop: your prices, your payment terms, the same confirmation and shipping e-mails to your account's e-mail. Products are identified by ean.

{
  "reference": "PO-2026-0042",          // required: YOUR order number (max 64) — see "Safe retries"
  "lines": [ { "ean": "0650311612944", "quantity": 2 } ],     // 1–200 lines, quantity 1–9999
  "shippingAddress": {                  // optional: leave it out to deliver to your own company address
    "fullName": "Ana Novak", "company": "Novak d.o.o.",
    "streetLine1": "Slovenska cesta 1", "streetLine2": null,
    "postalCode": "1000", "city": "Ljubljana", "countryCode": "SI",
    "phoneNumber": "+386 31 000 000"     // required — the courier calls or texts it
  },
  "delivery": { "method": "carrier", "carrier": "gls" },  // optional — see "Delivery" below
  "note": "Deliver after 2 pm",         // optional, max 1000
  "payment": "contract",                // optional: "contract" or "bank-transfer"
  "language": "sl"                      // optional: the e-mails' language (sl, en, hr, de, it, sr, bs, es, fr, pl, ro)
}

{ "data": { "currency": "EUR",
  "totals": { "products": 36, "shipping": 3.9, "net": 39.9, "vat": 8.78, "total": 48.68 },
  "lines": [ { "ean": "0650311612944", "quantity": 2, "unitPrice": 18, "lineTotal": 36, "vatRate": 22 } ],
  "delivery": { "method": "carrier", "countryCode": "SI" } } }

Drop-shipping

We send the parcel straight to your customer. Two ways:

• With our carrier — "delivery": { "method": "carrier" } with your customer as shippingAddress. Shipping is charged as usual. Nothing of ours goes in the parcel — no invoice, delivery note or promotional material.
• With your own label (free) — you buy the shipment with your own carrier account and give us the label; we pack the order and hand it over with your label:

"shippingAddress": { …your customer, as on the label… },
"delivery": {
  "method": "dropship",
  "label": {
    "url": "https://your-system.com/labels/PO-2026-0042.pdf",   // https link to the PDF …
    // "pdfBase64": "JVBERi0xLjQK…",                             // … or the PDF itself, base64
    "carrier": "GLS",                                            // optional: the carrier on the label
    "trackingNumber": "6260123456"                               // optional: the parcel number on the label
  }
}

The label must be a PDF of at most 5 MB. A link must be https, publicly reachable without a login, and must not redirect — we download it once when the order is placed, so it only needs to work for a few minutes. carrier and trackingNumberare optional — when you give the tracking number, the order object reports it as the shipment's tracking. We print nothing of ours for a drop-shipping parcel: no invoice, no delivery note.

The order object

Amounts are in EUR (net = without VAT). Each line says how much has shipped and how much is still open; each shipment says what went in which parcel — so a part delivery is always clear: what you got, and what is still coming.

{
  "code": "133750512",                 "reference": "PO-2026-0042",
  "status": "partially_shipped",       // received | partially_shipped | shipped | delivered | cancelled
  "state": "PartiallyShipped",         // our internal state, for support
  "placedAt": "2026-10-15T20:39:59.713Z", "updatedAt": "…", "currency": "EUR",
  "totals": { "products": 36, "shipping": 3.9, "net": 39.9, "vat": 8.78, "total": 48.68 },
  "lines": [ { "ean": "0650311612944", "name": "3D naslonjala za roke",
               "ordered": 2, "cancelled": 0, "shipped": 1, "open": 1,
               "unitPrice": 18, "lineTotal": 36, "vatRate": 22,
               "inStock": false, "expectedAt": "2026-11-05" } ],   // only while open: can it ship now? if not, when (if known)
  "shipments": [ { "shippedAt": "…", "delivered": false,
                   "parcels": [ { "trackingNumber": "16962038820121", "carrier": "DPD", "trackingUrl": "https://…" } ],
                   "lines": [ { "ean": "0650311612944", "quantity": 1 } ] } ],
  "delivery": { "method": "carrier", "dropship": false, "carrier": "DPD", "address": { … } },   // method: carrier | pickup | dropship
  "billingAddress": { … },
  "payment": { "method": "contract", "paid": false, "dueDays": 30, "reference": "133750512" },
  "invoiceNumber": null,               "note": null
}

Order errors (HTTP 422) say what to fix: INVALID_INPUT (with details, one entry per field), UNKNOWN_PRODUCT (details.eans), LABEL_UNUSABLE, NO_SHIPPING, NO_COMPANY_ADDRESS, PAYMENT_UNAVAILABLE, CANNOT_ADD. Nothing is saved when an order is refused. A line still open says whether it can ship now (inStock) and, when it cannot, the expected restock date (expectedAt, when we know it).

Webhooks

Instead of asking us every few minutes, let us tell you. Set one https URL under Account → Export → API, choose the events and press "Send a test". We send a POST with a JSON body:

{ "id": "6f1c…",                     // unique per delivery, SAME on every retry — ignore one you have already processed
  "event": "order.updated",          // or "products.changed", "catalog.updated", "test"
  "createdAt": "2026-10-15T21:21:19.015Z",
  "data": { … } }

• order.updated — any change of one of your orders: received, shipped, partly shipped (with tracking), delivered, cancelled. data is the full order object.
• catalog.updated — the product content changed: data = { "changes": [ … ] }, the same entries as GET /products/changes (field by field, up to 100 per delivery).
• products.changed — checked every 5 minutes; only the products whose price, stock or availability changed: data = { "products": [ /stock rows ], "removed": [ eans no longer sold ] }, at most 500 products per delivery.
• Answer with any 2xxwithin 10 seconds (do the work afterwards). A failed delivery is retried after 1 min, 5 min, 30 min, 2 h, 6 h and 24 h (the retries survive a restart on our side). Deliveries can arrive out of order — use the order's updatedAt. After 50 failures in a row the webhook switches off (the Export page says so — save it again to switch it back on).
• Webhooks are a notification, not the only copy: if you were offline, GET /orders?updatedSince=… and GET /stock give you everything.

Check the signature

Every delivery carries X-Legit-Signature: t=<unix seconds>,v1=<hex> — an HMAC-SHA256 of "<t>.<raw body>" with your signing secret (whsec_…, shown once on the Export page). Compute it over the RAW body, compare, and reject deliveries older than 5 minutes:

// Node.js (Express: app.post('/legit-webhook', express.raw({ type: 'application/json' }), handler))
import crypto from 'node:crypto';
function verify(rawBody, header, secret) {
  const { t, v1 } = Object.fromEntries(header.split(',').map(p => p.split('=')));
  const expected = crypto.createHmac('sha256', secret).update(t + '.' + rawBody).digest('hex');
  return Math.abs(Date.now() / 1000 - Number(t)) < 300 &&
         crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}

<?php // PHP
$raw = file_get_contents('php://input');
parse_str(str_replace(',', '&', $_SERVER['HTTP_X_LEGIT_SIGNATURE'] ?? ''), $sig);
$expected = hash_hmac('sha256', $sig['t'] . '.' . $raw, getenv('LEGIT_WEBHOOK_SECRET'));
if (!hash_equals($expected, $sig['v1'] ?? '') || abs(time() - (int)$sig['t']) > 300) { http_response_code(400); exit; }
http_response_code(200);
$event = json_decode($raw, true);   // then process $event['event'] / $event['data']

Freshness, caching, limits

• Product texts, specifications, images and documents refresh hourly.
• Prices and stock are at most 5 minutes old; an identical request inside 5 minutes returns the same answer.
• With webhooks you do not need to poll. Without them: the full product list at most every few hours, /stock at most every 15 minutes (an identical request inside 5 minutes gets the same answer anyway).
• Orders are always live — never cached. To follow them, call /orders?updatedSince=… every 5–15 minutes.
• Hard limit: 120 requests per minute per account (HTTP 429 above it).

Errors

JSON with an HTTP status:

401 { "error": "UNAUTHORIZED",  "message": "Missing or invalid API key …" }
404 { "error": "NOT_FOUND",     "message": "…" }
429 { "error": "RATE_LIMITED",  "message": "At most 120 requests per minute." }
422 { "error": "INVALID_INPUT", "message": "…", "details": [ { "field": "lines[0].ean", "message": "Required." } ] }
500 { "error": "EXPORT_FAILED", "message": "…" }        retry later
500 { "error": "ORDER_FAILED",  "message": "…" }        retry with the SAME reference
503 { "error": "UNAVAILABLE",   "message": "…" }        retry later

Moving from XML to the API

The data is the same — every XML element has a JSON field of the same name. A safe order of work:

1. Keep your XML import running as it is.
2. Add a small job that calls /stock every 5–15 minutes and updates only price and stock, matched by ean. This alone gives you fresher stock than any feed.
3. Replace the full XML import with /products: page through it with limit=500 until page equals totalPages, create or update by ean. Run it every few hours.
4. When both jobs run cleanly for a few days, switch the XML import off.
5. Never delete products because one run failed — only after a complete, successful run.

// Node.js 18+: refresh price + stock by EAN
const r = await fetch('https://b2b.legit.si/api/v1/stock', { headers: { Authorization: 'Bearer ' + process.env.LEGIT_API_KEY } });
if (!r.ok) throw new Error('LEGIT API ' + r.status);
for (const row of (await r.json()).data) {
  // updateMyProduct(row.ean, { cost: row.price, stock: row.stock })
}

<?php // PHP: the same with cURL
$ch = curl_init('https://b2b.legit.si/api/v1/stock');
curl_setopt_array($ch, [CURLOPT_RETURNTRANSFER => true, CURLOPT_HTTPHEADER => ['Authorization: Bearer ' . getenv('LEGIT_API_KEY')]]);
$rows = json_decode(curl_exec($ch), true)['data'];
foreach ($rows as $row) { /* update price + stock by $row['ean'] */ }

The base URL and the key stay the same. Fields are only ever added; a breaking change would come as /api/v2.

Instructions for AI

The whole contract in one file for ChatGPT, Claude or Copilot — give it the file and the name of your shop system: ⬇ Instructions for AI — API.

Changelog

• 2026-10-17 — product changes field by field: GET /products/changes and the catalog.updated webhook.
• 2026-10-17 — test orders (?test=true), POST /orders/{code}/cancel, read-only keys, carrier preference and pickup, inStock / expectedAt on open lines, webhook retries up to 24 h, /openapi.json.
• 2026-10-15 — webhooks (order.updated, products.changed), GET /orders/{code}/invoice, POST /orders/quote.
• 2026-10-15 — orders: POST /orders (safe retries by reference, drop-shipping with your label or our carrier), GET /orders, GET /orders/{code or reference} with shipped / open quantities and tracking.
• 2026-10-15 — v1: /me, /products, /products/{ean}, /stock. Products are identified by ean only (no separate SKU).

Questions or an integration we should know about: [email protected].