API overview & authentication

The Transactful API gives you programmatic access to your store’s credit data – companies under credit management, the ledger, applications, holds – for connecting ERPs, accounting tools, dashboards, or your own automation.

Base URL   https://api.transactful.com/v1
Format     JSON · UTF-8 · amounts as decimal strings with a currency
Versioning Path-versioned (/v1); breaking changes only ever arrive in a new version

Authentication

Create API keys in Transactful → Settings → API. Every key is scoped to the single store it was created in and carries the permissions you choose at creation:

Scope	Grants
read_credit	Companies’ limits, balances, ledger entries, holds
read_applications	Wholesale applications and their statuses
write_credit	Adjustments, limit changes, place/lift holds

Send the key as a bearer token:

curl https://api.transactful.com/v1/companies \
  -H "Authorization: Bearer tk_live_9f2c…"

Keys can be rotated (old key keeps working for 24 h) and revoked instantly. Every key’s last-used time is visible in settings; unused keys prompt a cleanup nudge after 90 days.

Rate limits, idempotency, errors

• 120 requests/minute per store; 429 with Retry-After beyond it.
• Write requests accept an Idempotency-Key header – retries with the same key never double-apply.
• Errors are JSON with a stable machine code and a human sentence:

{ "error": { "code": "limit_below_zero", "message": "Credit limit must be zero or greater." } }

Built inside Shopify’s rules

This API is designed against Shopify’s API License and Terms of Use and protected customer data requirements, and we hold ourselves to them explicitly:

• Merchant-scoped by construction. A key returns data for its own store, full stop. There is no cross-store access, no aggregate endpoints, and no way to query another merchant’s data.
• We never proxy Shopify’s APIs. Responses contain Transactful’s records (applications, ledger entries, credit accounts) with Shopify GID references (e.g. gid://shopify/Company/…) – never embedded Shopify resources. To read the Shopify objects themselves, use Shopify’s Admin API under your own store’s credentials.
• Personal data is minimized. Endpoints return buyer business data by default; personal contact fields require the read_applications scope, are never included in ledger or credit responses, and GDPR erasure propagates – a redacted person is redacted in API responses too.
• Your obligations flow down. Our Terms of Service require that anything you build on this API uses merchant data only to serve that merchant – the same standard Shopify holds us to. Reselling, aggregating, or brokering data accessed through this API is prohibited.
• No AI training. We don’t use merchant or customer data to train models, and our terms prohibit API consumers from doing so with data obtained through us.

If you’re evaluating this as part of app review or a security assessment and want more detail, email [email protected] – compliance questions get direct answers.