API & docs

One key. Every module.

Most business software gives you an API per product — one for the till, another for stock, a third for invoices, each with its own auth and its own idea of a date. Kardopal has one. The same key, the same base URL and the same query grammar reach 133 resources across 30 modules.

Create an API key See what it reaches
30
Modules
133
الموارد
1
Key, one base URL
200
Rows per page, max

Why this API is worth building on

Six things that are true here and are usually not.

It describes itself

Hit the base URL and the API hands back its own catalogue — every module your key can see, every resource inside it, which fields are searchable and which are filterable. You do not need this page to write the integration; you need it to decide to.

Permissions that actually gate

Scopes, routes and the permission pills in the app are generated from one list, so a permission cannot be offered unless there is an endpoint behind it. A key scoped to items gets items — asking it for payroll returns 403, not a silent empty page.

One query grammar, everywhere

search, since, until, skip and take mean the same thing on invoices as they do on stock movements. Learn the shape once and every one of the 133 resources answers to it.

Your tenant, and only yours

Every table carries a tenant id and every query is scoped to the key’s own tenant before it reaches the database. There is no cross-tenant read to get wrong, because there is no parameter that could ask for one.

Fields keep themselves honest

The field list is read from the live schema at boot rather than hand-maintained. A new column shows up on its own; a dropped one can never leave a dangling reference in the docs or a 500 on first call.

Read-only, on purpose

Keys read; they never write. An integration that goes wrong cannot void an invoice or move stock. Anything that changes a record goes through the app or a staff login, where it is attributed to a person and lands in the audit log.

Start in one request

Everything is a GET. If you can use curl, you can use this.

GET /api/v1The whole catalogue your key can see
curl https://api.kardopal.com/api/v1 \
  -H "X-API-Key: kp_live_…"
GET /api/v1/meSanity probe — whose key is this, and what can it read
{
  "authType": "api_key",
  "tenant": { "name": "Nova Retail", "plan": "pro" },
  "scopes": ["items", "sales", "pos"]
}
GET /api/v1/items?search=lamp&take=2Any resource, same shape
{
  "resource": "items",
  "scope": "items",
  "total": 41,
  "skip": 0,
  "take": 2,
  "hasMore": true,
  "data": [ { "id": "…", "name": "Desk Lamp LED" } ]
}
GET /api/v1/meta/countsRow count per resource — see what data actually exists
curl https://api.kardopal.com/api/v1/meta/counts \
  -H "X-API-Key: kp_live_…"

The five parameters

ParameterDoesالملاحظات
searchCase-insensitive match across the resource’s searchable fieldsWhich fields those are is listed in /meta
sinceOnly records from this date forwardApplies to the field the resource sorts by
untilOnly records up to this dateCombine with since for a window
skipOffset into the result setDefaults to 0
takeHow many rows to returnDefaults to 50, capped at 200

Resources also accept exact-match filters on their own declared fields — ?status=paid, ?warehouseId=… — and each one advertises which those are. Every list response carries total and hasMore, so paging is a loop, not a guess.

What the API reaches

30 modules, 133 resources. Each card is one permission you can grant a key — and the grey tag is where the same records live in the app on your phone.

جهات الاتصال

2

Customers, suppliers and the segments they sit in.

contactscontact-segments
contacts جهات الاتصال

الأصناف

7

The catalogue: products, variants, brands, price lists and units.

itemscategoriesbrandsitem-variantsprice-listsunits+1 more
items الأصناف

المخزون

7

Warehouses, stock levels, movements, batches, serials and bins.

warehousesstock-movementsstock-levelsbatchesserialsstock-counts+1 more
inventory المخزون

المبيعات

7

Invoices, estimates, orders, credit notes and payments.

invoicesestimatessales-orderscredit-notespaymentsrecurring-invoices+1 more
sales المبيعات

POS

11

Tills, shifts, receipts, tables and every sale that crossed the counter.

pos-salespos-shiftspos-terminalspos-userspos-tablespos-table-areas+5 more
pos POS

CRM

4

Leads, deals, pipelines and proposals.

leadsdealspipelinesproposals
crm CRM

الشراء

5

Purchase orders, requests, returns, bills and vendor payments.

purchase-orderspurchase-requestspurchase-returnsbillsvendor-payments
purchase الشراء

المحاسبة

5

Expenses, bank accounts, transactions and tax rates.

expensesexpense-categoriesbank-accountsbank-transactionstax-rates
accounting المحاسبة

التسويق

4

Campaigns, recipients, landing pages and form submissions.

campaignscampaign-recipientslanding-pagesform-submissions
marketing التسويق

HR

8

People, departments, leave, payslips, attendance and hiring.

employeesdepartmentsleave-requestspayslipsattendancejob-postings+2 more
hr HR

جدول الدوام.

2

Time entries and the projects they are booked against.

time-entriestimesheet-projects
timesheet جدول الدوام.

المشاريع

3

Projects, phases and the costs attached to them.

projectsproject-phasesproject-costs
projects المشاريع

الحجز

3

Appointments, bookable services and the staff who deliver them.

bookingsbooking-servicesbooking-staff
booking الحجز

الخدمة الميدانية

7

Jobs, technicians, work orders, contracts and equipment.

field-jobstechniciansservice-requestsservice-contractswork-ordersjob-cards+1 more
field_service الخدمة الميدانية

اللوجستيات.

5

Shipments, drivers, vehicles, zones and carriers.

shipmentsdriversvehiclesdelivery-zonescarriers
logistics اللوجستيات.

مكتب المساعدة

5

Tickets, SLA policies, help articles and the knowledge base.

ticketscustomer-ticketshelp-articlesknowledge-basesla-policies
support مكتب المساعدة

Post-Sales

5

Returns, warranty claims, repairs and product registrations.

rmaswarranty-claimswarranty-registrationsrepairsproduct-registrations
post_sales Post-Sales

الإيجار

3

Rentable assets, rental agreements and their lines.

assetsrentalsrental-lines
rental الإيجار

Restaurant

2

The menu and the orders placed against it.

menu-itemsmenu-orders
restaurant المأكولات والمشروبات

قائمة الانتظار

5

Tickets, services, counters, branches and the display screens.

queue-ticketsqueue-servicesqueue-countersqueue-branchesqueue-displays
queue قائمة الانتظار

الولاء

6

Members, accounts, tiers, rewards and point transactions.

loyalty-membersloyalty-accountsloyalty-rewardsloyalty-tiersloyalty-transactionsloyalty-coupons
loyalty الولاء

التصنيع

4

Work orders, bills of materials, work centres and QC.

work-orders-mfgbomswork-centersquality-inspections
manufacturing مصنع

Locations

2

Sites and branches.

locationsbranches
locations Locations

IOT

6

Devices, sites, boxes, alerts, events and signage content.

iot-devicesiot-sitesiot-alertsiot-eventsiot-boxesiot-signage-content
iot IOT Hub

استوديو الذكاء الاصطناعي

3

Generated assets, the projects holding them and job history.

ai-assetsai-projectsai-jobs
ai_studio استوديو الذكاء الاصطناعي

التجارة

3

Network members, quote requests and collections.

network-membersquote-requestscollections
commerce التجارة

التوقيع الإلكتروني

2

Signature requests and the signatures collected against them.

signature-requestssignatures
signature e-Sign

الموافقات

2

Approval requests and the rules that route them.

approval-requestsapproval-rules
approvals الموافقات

الملفات

2

Uploaded files and scanned documents.

filesscanned-documents
files الملفات

Activity

3

The activity feed, audit log and notifications.

activitiesaudit-logsnotifications
On the phone

Every module the API reads, your team can open in their hand

This is the part that usually is not true. Plenty of platforms expose a broad API and then ship a mobile app that does three things — approve, view, notify. Kardopal’s app is the product, not a companion: all 30 modules above have real screens, and the phone is where most of the work actually happens.

  • Read it, then act on it. Your integration pulls a stock level; the person who has to fix it opens the same record, adjusts it and it is signed to their name.
  • Scan, shoot, sign. Barcode scanning, document capture and e-signature are phone-native — they have no desktop equivalent worth using.
  • Offline-tolerant at the counter. The till, the kitchen screen and the queue display keep serving when the connection stutters.
  • Same login, same data, 21 languages. Including right-to-left, so an Arabic-speaking team is not reading a mirrored layout.
اطلع على المنصة.
The Kardopal app running on a phone

Getting a key

Open the app, go to Platform → API Keys.Keys are created by an owner or admin on your own tenant. Nobody at Kardopal issues them for you.
Tick only the modules that integration needs.A shop-window widget needs items. It does not need hr. Narrow keys fail safe.
Send it as a header, never in the URL.X-API-Key: kp_live_… — query strings end up in logs, proxies and browser history.
Rotate by creating the new key first.Both work at once, so you can move traffic across and revoke the old one with no window of downtime.

Build something on it

The API documents itself: create a key in the app, point curl at the base URL, and it hands back every module, resource and searchable field that key can reach.

Create an API key