# Canix

> Canix is a cannabis enterprise resource planning (ERP) and seed-to-sale platform for licensed
> cultivators, manufacturers and distributors. It publishes a public OpenAPI 3.0.3 contract
> (74 operations) for its REST API at api.canix.com, and operates a hosted Model Context Protocol
> server at api.canix.com/mcp for natural-language querying of sales data.

Generated by API Evangelist from the Canix apis.yml profile and harvested artifacts.
Canix does not publish an llms.txt of its own (https://www.canix.com/llms.txt returns 404),
so this file is generated, not verbatim.

Authentication in one line: REST calls carry a company-scoped API key in an `X-API-KEY` header;
the MCP server uses OAuth 2.1 (authorization code + PKCE S256, dynamic client registration,
single `mcp` scope). Collections accept `limit` (max 2000), `offset`, `order_by` and a SQL-like
`where` clause. There is no idempotency contract, no rate-limit header, and no webhook surface.

## APIs

- [Canix API](https://www.canix.com/product/api): REST API over a cannabis operator's Canix
  account — sales orders, purchase orders, customers, vendors, items, packages, plants, plant
  batches, harvests, transfers, bills of materials, manufacturing batches and runs, standard costs.
  Base URL `https://api.canix.com/api/v1`.
- [Canix MCP Server](https://www.canix.com/blog-posts/ask-your-data-anything-canix-launches-mcp-server):
  Hosted MCP server at `https://api.canix.com/mcp`, announced 2026-07-09. Sales reporting is live;
  inventory is announced as coming soon. `tools/list` is OAuth-gated, so the tool names are not public.

## Specs

- [OpenAPI 3.0.3 (Canix API)](https://api.canix.com/api.yaml): the live spec, version 1.3.10.
- [Swagger UI reference](https://api.canix.com/api-docs-swagger/index.html): the rendered reference.
- [OAuth authorization server metadata](https://api.canix.com/.well-known/oauth-authorization-server)
- [OAuth protected resource metadata](https://api.canix.com/.well-known/oauth-protected-resource)

## Docs

- [API product page](https://www.canix.com/product/api)
- [Request an API key](https://www.canix.com/developer): contact form; keys are generated inside
  the app at https://app.canix.com/company/api.
- [Integrations](https://www.canix.com/integrations): Metrc, BioTrack, CCRS, LeafLink, Dutchie,
  QuickBooks, Sage Intacct, Onfleet, Confident Cannabis, Green Check Verified, MyTrace, WayFast,
  Outlaw Technology, StashStock, Lendica, Ohaus, Zebra.
- [Help Center](https://help.canix.com/hc/en-us): returns 403 to non-browser clients.
- [Blog](https://www.canix.com/blog)
- [Status page](https://status.canix.com/): Atlassian Statuspage; tracks Canix API plus upstream
  Metrc, LeafLink, QuickBooks Online and Onfleet.
- [Terms & conditions](https://www.canix.com/terms-conditions)
- [Privacy policy](https://www.canix.com/privacy-policy)

## Capability surface

Cultivation: `GetStrains`, `CreateStrain`, `GetStrainById`, `UpdateStrain`, `GetPlantBatches`,
`GetPlantBatchById`, `GetPlants`, `GetPlantsCount`, `GetPlantById`, `GetHarvests`, `GetHarvestById`.

Inventory and compliance: `GetPackages`, `GetPackageById`, `GetLocations`, `GetLocationsCount`,
`GetLocationById`, `GetTransfers`, `GetTransferById`, `GetTransferDestinations`,
`GetTransferDestinationById`, `GetAuditedActions`, `CreateMETRCItemPhotos`, `CreateMETRCItemFiles`.

Catalog: `GetItems`, `CreateItem`, `GetItemById`, `UpdateItem`, `DeleteItem`, `GetItemTypes`,
`GetItemSubTypes`, `GetBrands`, `GetProducts`, `GetProductById`, `GetNonCannabisProducts`,
`PostNonCannabisProduct`, `GetNonCannabisProductById`, `GetNonCannabisProductBOMs`, `GetWeightUnits`.

Sales: `GetSalesOrders`, `CreateSalesOrder`, `GetSalesOrderById`, `UpdateSalesOrder`,
`UpdateSalesOrderStatus`, `GetSalesOrderContentsById`, `GetSalesOrderPayments`, `GetPayments`,
`GetPaymentById`, `GetCustomers`, `GetCustomerById`, `AdjustCustomerCredit`.

Purchasing: `GetPurchaseOrders`, `PostPurchaseOrder`, `GetPurchaseOrderById`,
`GetPurchaseOrderContentsById`, `GetpurchaseOrderPayments`, `GetVendors`, `CreateVendor`,
`GetVendorById`, `UpdateVendor`, `DeleteVendor`.

Manufacturing and costing: `GetBillOfMaterialsById`, `GetManuBatches`, `GetManuBatchById`,
`GetManuBatchRuns`, `GetManuBatchRunById`, `AddItemStandardCost`, `GetStandardCost`,
`UpdateStandardCost`, `DeleteStandardCost`.

Account: `GetFacilities`, `GetFacilityById`, `GetCompanyById`, `GetSubmissionById`.

## Artifacts (API Evangelist)

- openapi/canix-openapi-original.yml — the harvested spec, verbatim
- authentication/canix-authentication.yml — both auth models, REST and MCP
- scopes/canix-scopes.yml — the single `mcp` OAuth scope
- conventions/canix-conventions.yml — pagination, filtering, tracing, and the missing idempotency contract
- errors/canix-problem-types.yml — the error envelope, probed live
- data-model/canix-data-model.yml — 76 entities, 126 relationships
- lifecycle/canix-lifecycle.yml — versioning, status page, and what is not published
- conformance/canix-conformance.yml — standards conformance, including the OIDC-path deviation
- mcp/canix-mcp.yml and mcp/canix-tool-crosswalk.yml — the MCP surface and its gated tool list
- well-known/canix-well-known.yml — the OAuth discovery surface
- security/canix-domain-security.yml — TLS, HSTS, DNSSEC, CAA, SPF, DMARC
- agentic-access/canix-agentic-access.yml — recommended x-agentic-access contracts for all 74 operations
- skills/ — packaged agent skills grounded in real operationIds

## Notes for agents

- Anonymous REST calls return `403 {"message":"Access Denied"}`, not 401, so a missing key and an
  unauthorized key look identical.
- `where` is SQL-like string syntax. Never interpolate untrusted user text into it.
- Writes are not idempotent. Do not blind-retry `CreateSalesOrder`, `PostPurchaseOrder` or
  `AdjustCustomerCredit` after a timeout — read back first.
- Some writes are queued and return a Submission; poll `GetSubmissionById` for terminal status.
- Collections return bare arrays with no total count; page until a short page returns.
- Correlate support requests with the `x-request-id` response header.