Integrating · For a developer
The API, stated honestly
AVRA's API is the one the console uses. It is a REST API over JSON, served from the same origin as the console, authenticated with a bearer token from POST /api/auth/token, and scoped to the tenant that token belongs to. Every route the console calls, you can call.
What we do not yet have #
Long-lived API keys. Today integrating means holding console credentials, and that is a poor answer for a production integration — a password rotation breaks your job. Issued API keys, scoped per tenant and revocable, are not built yet. When issued keys ship they will be part of the Pro plan. Until then, tell us what you are building and we will work out the safest way to do it with what exists.
If you are a printer integrating your MIS or VDP software, you probably do not need the API at all. The batch upload and the print-file export cover the whole job, are already idempotent on retry, and do not require you to hold a credential that can activate a batch.
Authentication and scoping #
POST /api/auth/token returns a session token. Send it as Authorization: Bearer <token>. It is a session like the console's: it ends 12 hours after it was issued, after 2 hours unused (10 for a brand running Inventory Management), when you call POST /api/auth/logout with it, or when the password is changed or reset. Every query runs inside the token's tenant; a request for another tenant's record answers 404, never 403, because a 403 would confirm the record exists.
What exists today #
POST /api/auth/token- Auth
- none, rate-limited
- What it does
- Exchange an email and password for a bearer token (a script's session).
GET /api/admin/batches- Auth
- bearer
- What it does
- List the batches your tenant can see, paginated.
POST /api/admin/batches/{id}/exports- Auth
- bearer
- What it does
- Queue a print export for a batch. Background job.
GET /api/admin/exports/{job_id}- Auth
- bearer
- What it does
- Poll an export job's state.
GET /api/admin/exports/{job_id}/download- Auth
- bearer
- What it does
- Download a finished export, subject to the activation rule.
GET /api/admin/brands,GET /api/admin/brands/{id}- Auth
- bearer (the list: partner and admin logins only)
- What it does
- Brands, with their product, batch and label counts.
GET /api/dashboard/stats,/series,/cities,/regions,/alerts,/recent-scans- Auth
- bearer
- What it does
- The dashboard's own reads.
GET /api/public/brand/{token}- Auth
- the share token
- What it does
- The read-only report a brand shares by link.
GET /api/scan/{code}- Auth
- none, rate-limited
- What it does
- The verdict for one code. Every call is a real scan: it is recorded and it can claim.
Errors #
Errors are JSON with a detail field: 400 for a request the rules refuse, 401 for a missing or expired token, 403 for a route your role, or your login's permissions, may not use, 404 for anything outside your tenant, 422 for a malformed body, and 429 when a rate limit is hit. A 403 is never about another tenant's record.
The schema #
We do not publish the OpenAPI schema yet. Ask for the current one at connect@avrascan.com and we will send it.
Last reviewed 19 Oct 2026 · Something wrong? connect@avrascan.com