openapi: 3.0.3
info:
  title: OpenCart REST Affiliates Authentication API
  description: 'The OpenCart REST API enables external applications to communicate with a self-hosted OpenCart store. It provides endpoints for managing the shopping cart, customers, orders, addresses, shipping methods, payment methods, subscriptions, and affiliates. Authentication is performed by submitting API credentials to receive a session token, which must accompany subsequent requests. IP-allowlist enforcement is applied at the store level.

    '
  version: '4.0'
  contact:
    name: OpenCart Developer Documentation
    url: https://docs.opencart.com/developer/
  license:
    name: GNU GPL v3
    url: https://github.com/opencart/opencart/blob/master/LICENSE.md
servers:
- url: https://yourstore.com/index.php?route=api
  description: OpenCart store API base URL (replace yourstore.com with your store domain)
security:
- apiToken: []
tags:
- name: Authentication
  description: API login and session token management
paths:
  /login:
    post:
      operationId: apiLogin
      summary: Authenticate and obtain API session token
      description: 'Submits API username and key credentials to authenticate. Returns a session api_token that must be passed as a query parameter or POST field on all subsequent requests. The calling IP address must be in the store''s API IP allowlist.

        '
      tags:
      - Authentication
      security: []
      requestBody:
        required: true
        content:
          application/x-www-form-urlencoded:
            schema:
              type: object
              required:
              - username
              - key
              properties:
                username:
                  type: string
                  description: API username configured in Admin > System > Users > API
                  example: Default
                key:
                  type: string
                  description: API key (64-character alphanumeric secret)
                  example: abcdefghijklmnopqrstuvwxyz1234567890abcdefghijklmnopqrstuvwxyz12
      responses:
        '200':
          description: Successful authentication
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: string
                    description: Localised success message
                    example: 'Success: You have modified APIs!'
                  api_token:
                    type: string
                    description: Session token to use for subsequent requests
                    example: 7a2f4e9c1d8b3f6a0e5c2d9b4f7a1e3c
        '400':
          description: Authentication failed (bad credentials or IP not allowed)
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          description: Localised error message
          example: 'Warning: Permission Denied!'
  securitySchemes:
    apiToken:
      type: apiKey
      in: query
      name: api_token
      description: Session token obtained from the /login endpoint
externalDocs:
  description: OpenCart Admin API Documentation
  url: https://docs.opencart.com/admin-interface/system/users/api