Webhooks & API

Today, IEMSuite integrates with external systems through its native Shopify sync. A public REST API and outbound webhooks are on the roadmap - this page previews what they will look like so you can plan ahead.

Available Today: Shopify

If you sell on Shopify, the built-in integration already keeps inventory and orders in sync in real time with no code. See Integrations → Shopify Deep Sync for setup and sync behavior.

Planned: Outbound Webhooks

Outbound webhooks send an HTTP POST to your endpoint when a specific event occurs in IEMSuite. Common use cases:

• Notify an ERP system when a production batch closes
• Trigger a reorder alert in Slack when stock falls below a threshold
• Sync order data to an accounting system on invoice
• Push lot expiry alerts to a food safety system

Planned Events

Planned Payload Structure

All webhook payloads follow the same envelope structure:

{
  "event": "stock_lot.created",
  "organizationId": "org_abc123",
  "timestamp": "2024-11-15T14:32:00Z",
  "data": {
    "id": "lot_xyz789",
    "product": { "id": "prod_...", "sku": "RAW-SUGAR-001" },
    "quantity": 500,
    "unit": "kg",
    "location": { "id": "loc_...", "name": "Main Warehouse" },
    "status": "AVAILABLE",
    "receivedAt": "2024-11-15T14:30:00Z"
  }
}

Planned: Signatures

Each webhook delivery includes an X-IEMSuite-Signature header - an HMAC-SHA256 signature of the raw request body using your webhook secret. Verify this signature in your endpoint to confirm the request is genuine.

// Node.js example
const crypto = require('crypto');
const sig = req.headers['x-iemsuite-signature'];
const expected = 'sha256=' + crypto
  .createHmac('sha256', process.env.WEBHOOK_SECRET)
  .update(req.rawBody)
  .digest('hex');
if (sig !== expected) return res.status(401).send('Invalid signature');

Planned: Public API

A REST API is planned so you can read and write inventory, orders, and production data programmatically. When it ships, you will generate a key from your workspace settings and pass it as a Bearer token. This is the intended shape of a request:

curl https://app.iemsuite.com/api/v1/stock-lots \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json"

Planned Rate Limits