Reseller API v1

Programmatic access to the catalog, tier pricing, wallet balance, instant-delivery ordering and webhooks. Product discovery is public; sending the API key from your dashboard adds partner-only products and your tier pricing. Balance, ordering and webhook operations require it in the X-Api-Key header. The machine-readable spec lives at /api/v1/openapi (OpenAPI 3.1).

Ordering variations: product detail exposes variation axes and combination prices; order a specific combination with items[].sku = "13200::0-0" (option indexes per axis). All order creation requests require an Idempotency-Key header; previews do not.

Server-to-server only: keep the API key in your backend or secret manager. The API does not enable credentialed browser CORS, so never expose a live key in JavaScript shipped to customers.

Webhook verification: compute HMAC-SHA256 over the exact raw request body with the endpoint secret and compare it to X-Kiaveo-Signature. Reject missing, malformed or non-matching signatures before parsing the event.

// Node.js / Express
const got = req.get("X-Kiaveo-Signature");
const expected = "sha256=" + createHmac("sha256", secret)
  .update(req.rawBody).digest("hex");
if (!got || got.length !== expected.length ||
    !timingSafeEqual(Buffer.from(got), Buffer.from(expected)))
  return res.sendStatus(401);

# Python / Flask
got = request.headers.get("X-Kiaveo-Signature", "")
expected = "sha256=" + hmac.new(
    secret.encode(), request.get_data(), hashlib.sha256
).hexdigest()
if not hmac.compare_digest(got, expected):
    abort(401)

The Developers page shows the last 50 attempts, HTTP result, replay controls and signing-secret rotation. The legacy X-Licendi-Signature header remains temporarily available during migration.

GET/api/v1/products

Paginated product list. Public without a key; with X-Api-Key it also includes partner-only products and your netPrice. Use limit (1–250) and offset.

curl -s -H "X-Api-Key: $KIAVEO_API_KEY" "https://kiaveo.com/api/v1/products?category=Windows&limit=50&offset=0"

GET/api/v1/products/{sku}

Product detail with honest availability, variation axes and per-combination prices. Each combination has an orderSku like 13200::0-0.

curl -s -H "X-Api-Key: $KIAVEO_API_KEY" https://kiaveo.com/api/v1/products/13200

GET/api/v1/balance

Wallet balance, tier, discount and your 20 most recent ledger entries.

curl -s -H "X-Api-Key: $KIAVEO_API_KEY" https://kiaveo.com/api/v1/balance

POST/api/v1/orders

Place an order. Settles against your wallet and returns delivered licence keys. Idempotency-Key is required so retries cannot double-charge.

curl -s -X POST -H "X-Api-Key: $KIAVEO_API_KEY" -H "Content-Type: application/json" -H "Idempotency-Key: my-po-2026-001" -d '{"items":[{"sku":"13200::0-0","qty":2}],"externalId":"PO-2026-001"}' https://kiaveo.com/api/v1/orders

GET/api/v1/orders

List your orders, newest first (?limit=50, max 200).

curl -s -H "X-Api-Key: $KIAVEO_API_KEY" "https://kiaveo.com/api/v1/orders?limit=10"

GET/api/v1/orders/{id}

Order detail including its invoice reference.

GET/api/v1/orders/{id}/keys

Flat list of delivered keys for an order. Returns 202 while supplier fulfilment is still pending.

curl -s -H "X-Api-Key: $KIAVEO_API_KEY" https://kiaveo.com/api/v1/orders/ord-xxxx/keys

POST/api/v1/reseller/bulk

Validate and preview a CSV or items-array wholesale order, then place it with an Idempotency-Key. preview: true never debits the wallet.

curl -s -X POST -H "X-Api-Key: $KIAVEO_API_KEY" -H "Content-Type: application/json" -d '{"csv":"sku,qty\n13200,2","preview":true}' https://kiaveo.com/api/v1/reseller/bulk

GET/POST/PATCH/DELETE/api/v1/webhooks

Manage webhook endpoints. Events: order.delivered, key.assigned. Deliveries carry an HMAC-SHA256 signature verified with the endpoint secret returned once at registration.

curl -s -X POST -H "X-Api-Key: $KIAVEO_API_KEY" -H "Content-Type: application/json" -d '{"url":"https://example.com/hooks/kiaveo","events":["order.delivered"]}' https://kiaveo.com/api/v1/webhooks

Getting a key: register at /reseller. Once your account is approved you'll find your API key and wallet in the dashboard. Tiers: Bronze −8%, Silver −12%, Gold −18% off list.