Integrating · For a developer
The API, stated honestly
AVRA's API is the one the console uses. It is a REST API over JSON, served from the same origin as the console, authenticated with a bearer token from POST /api/auth/token, and scoped to the tenant that token belongs to. Every route the console calls, you can call.
What we do not yet have #
Long-lived API keys. Today integrating means holding console credentials, and that is a poor answer for a production integration — a password rotation breaks your job. Issued API keys, scoped per tenant and revocable, are not built yet. Until then, tell us what you are building and we will work out the safest way to do it with what exists.
If you are a printer integrating your MIS or VDP software, you probably do not need the API at all. The batch upload and the print-file export cover the whole job, are already idempotent on retry, and do not require you to hold a credential that can activate a batch.
Authentication and scoping #
POST /api/auth/token returns a session token. Send it as Authorization: Bearer <token>. It is a session like the console's: it ends 12 hours after it was issued, after 2 hours unused, when you call POST /api/auth/logout with it, or when the password is changed or reset. Every query runs inside the token's tenant; a request for another tenant's record answers 404, never 403, because a 403 would confirm the record exists.
What exists today #
| Method and path | Auth | What it does |
|---|---|---|
POST /api/auth/token | none | Exchange an email and password for a bearer token (a script's session). |
GET /api/admin/batches | bearer | List the batches your tenant can see, paginated. |
POST /api/admin/batches/{id}/exports | bearer | Queue a print export for a batch. Background job. |
GET /api/admin/exports/{job_id} | bearer | Poll an export job's state. |
GET /api/admin/exports/{job_id}/download | bearer | Download a finished export, subject to the activation rule. |
GET /api/admin/brands, GET /api/admin/brands/{id} | bearer | Brands, with their product, batch and label counts. |
GET /api/dashboard/stats, /series, /cities, /regions, /alerts | bearer | The dashboard's own reads. |
GET /api/public/brand/{token} | the share token | The read-only report a brand shares by link. |
GET /api/scan/{code} | none, rate-limited | The verdict for one code. Every call is a real scan: it is recorded and it can claim. |
Errors #
Errors are JSON with a detail field: 400 for a request the rules refuse, 401 for a missing or expired token, 404 for anything outside your tenant, 422 for a malformed body, and 429 when a rate limit is hit.
The schema #
We do not publish the OpenAPI schema yet. Ask for the current one at connect@avrascan.com and we will send it.
Last reviewed 25 Sep 2026 · Something wrong? connect@avrascan.com