API fundamentals

API conventions

All public API traffic uses HTTPS. HTTP is not supported.

HTTP methods

GET reads data and is safe to retry.
POST creates a resource, runs a search, or executes a command depending on the operation; do not assume it is idempotent.
PUT creates or replaces the resource identified by the operation and is idempotent when repeated with the same body.
DELETE removes a resource and returns no response body when successful.

The generated operation reference is authoritative for the actual success status (200, 201, or 204) and whether an empty collection is represented by a body or no content.

Required headers

Header	Use
`Authorization`	OAuth bearer token.
`Ocp-Apim-Subscription-Key`	Customer subscription key.
`x-company-id`	Loady company ID whose data is addressed; required where shown in the operation.
`Accept-Language`	Optional ISO 639-1 language code; English is the default.
`Content-Type`	`application/json` for JSON request bodies.

The response includes x-correlation-id. You may supply one in the request; otherwise Loady generates it. Treat it as an opaque diagnostic value.

Versioning

The API version is a URI segment, for example /public/products/v2. Additive fields may be introduced within a version. Consumers must ignore unknown JSON fields. Field removal, renaming, semantic changes, and incompatible relationship changes require a new API version.

Use the version shown by the generated API reference. Products currently exposes both v1 and v2; new integrations should use v2.

Data formats

Requests and responses use JSON unless an operation says otherwise.
Send Accept: application/json when the client requires a JSON response.
Timestamps use RFC 3339 with a UTC offset, for example 2026-07-28T12:30:00Z.
Send JSON booleans as true or false.
For an absent optional list or object, omit the field or use null only where its schema permits it; do not send an empty string.
Dictionary-backed fields accept only values published by the Dictionaries API.

Throttling and retries

On 429 Too Many Requests, wait for Retry-After. Retry only transient failures and safe/idempotent operations automatically. Use bounded exponential backoff with jitter and retain the correlation ID for support.

Last modified on August 18, 2026

Authentication Errors

HTTP methods

GET reads data and is safe to retry.

POST creates a resource, runs a search, or executes a command depending on the operation; do not assume it is idempotent.

PUT creates or replaces the resource identified by the operation and is idempotent when repeated with the same body.

DELETE removes a resource and returns no response body when successful.

The generated operation reference is authoritative for the actual success status (200, 201, or 204) and whether an empty collection is represented by a body or no content.

Required headers

Header

Use

Authorization

OAuth bearer token.

Ocp-Apim-Subscription-Key

Customer subscription key.

x-company-id

Loady company ID whose data is addressed; required where shown in the operation.

Accept-Language

Optional ISO 639-1 language code; English is the default.

Content-Type

application/json for JSON request bodies.

The response includes x-correlation-id. You may supply one in the request; otherwise Loady generates it. Treat it as an opaque diagnostic value.

Versioning

Use the version shown by the generated API reference. Products currently exposes both v1 and v2; new integrations should use v2.

Data formats

Requests and responses use JSON unless an operation says otherwise.

Send Accept: application/json when the client requires a JSON response.

Timestamps use RFC 3339 with a UTC offset, for example 2026-07-28T12:30:00Z.

Send JSON booleans as true or false.

For an absent optional list or object, omit the field or use null only where its schema permits it; do not send an empty string.

Dictionary-backed fields accept only values published by the Dictionaries API.