Partner API

Build on Partova: sync our catalogue and fitment into your garage system, decode VINs, or keep your seller stock and prices up to date from your ERP. Ask your account manager for a key.

Authentication

Send your key in the x-api-key header. Keys are scoped; requests outside a key's scopes get 403. Limit: 600 requests per minute per key. Amounts are AED including VAT.

curl https://api.partova.ae/v1/public/products?limit=50 \
  -H "x-api-key: pk_live_xxxxxxxx_…"

Endpoints

Method	Path	Scope	What it does
GET	/v1/public/products	catalog:read	Paged catalogue with best price and stock. Use updatedSince for incremental sync.
GET	/v1/public/products/{id}	catalog:read	One product with every seller offer, the vehicle fitment table, OE numbers and supersessions.
GET	/v1/public/availability?ids=	catalog:read	Live price and stock for up to 100 products.
GET	/v1/public/vin/{vin}	fitment:read	Decode a VIN to maker, model year and candidate models with engines.
PUT	/v1/public/seller/offers/{productId}	inventory:write	Seller keys: set your price and on-hand stock. Stock can't drop below units reserved for open orders.
GET	/v1/public/seller/orders	orders:read	Seller keys: your shipments with lines and acceptance deadline.

Machine-readable spec: https://api.partova.ae/v1/public/openapi.json (OpenAPI 3.1).

Webhooks

Events: order.created and shipment.updated. Failed deliveries retry with back-off (1, 2, 4 … minutes) for up to 8 attempts. Verify every request:

const expected = "sha256=" + crypto
  .createHmac("sha256", WEBHOOK_SECRET)
  .update(req.headers["x-partova-timestamp"] + "." + rawBody)
  .digest("hex");
// compare with req.headers["x-partova-signature"] using a constant-time check,
// and reject timestamps older than 5 minutes.