The Pelcro Core API is a set of programming tools that allows you to directly integrate your own systems and applications with Pelcro's platform. Our RESTful API is easy to understand with predictable URLs and standard HTTP methods for actions and error handling. You can securely interact with the API from your web applications, and it uses JSON for all data communication.

Use-cases

Automated Tasks: Streamline your business processes by automating actions within Pelcro based on events or triggers in your external systems.
Customized Features: Build tailored functions and experiences beyond what's natively available in the Pelcro Dashboard.
Data Integration: Seamlessly sync data between Pelcro and your existing software tools like a CRM, accounting software, or other databases.
Advanced Reporting & Analytics: Pull raw data for custom reporting or integration with your own business intelligence tools.

Identification

In order to use Core API endpoints, your account needs to be identified, which is done via your Site ID. This identifier is not meant to be a secret. It is similar to a publishable key and is directly linked to your account. Therefore, the site_id is required at all times, either as a query parameter or as part of the body of the requests, depending on the endpoint.

You can retrieve your Site ID either from your Pelcro site settings, or in the browser URL of your Pelcro platform (e.g., https://pelcro.com/admin/{site_id}/customers).

Authentication

In addition to the site_id to identify your account, all requests needs to be authenticated. This is achieved by sending your API key as a Bearer token using the HTTP Authorization request header:

Host: www.pelcro.com
User-Agent: curl/8.7.1
Content-Type: application/json
Authorization: Bearer eyJ0eXA... <-- Your API key here

To create and manage API keys, head to the API keys management section in the platform, under your account settings. Note that only account owners & collaborators of type administrators can create and manage API keys.

Treat your API key as a confidential and sensitive password, Pelcro will never ask your for this information. Avoid sharing it with your colleagues, and do not share it publicly (e.g., in documentation, client-side code or in a repository in GitHub).

API authentication methods

OAuth 2.0

Use the industry standard OAuth 2.0 to authenticate requests to our Core API.

Here are the steps for authenticating with OAuth:

On the platform, go to settings > Applications.

Create a new application by clicking New in the top-right corner.
Specify the name of your application and the redirect URL, which is the URL the user will be redirected to after authorization. Then, click Create.
Upon successful creation, a pop-up will appear containing the Application ID and Application Secret. Please note that the application secret will not be displayed again, so be sure to copy and save it securely.

Next, initiate a GET request to https://pelcro.com/oauth/authorize the authorization endpoint to obtain your authorization code:

https://pelcro.com/oauth/authorize
?client_id=YOUR_APP_ID
&redirect_uri=YOUR_REDIRECT_URI
&scope=
&response_type=code
&response_mode=query
&state=
&nonce=

You will be redirected to the authorization page and upon clicking on authorize; you will be redirected to the redirect URI you specified, with the authorization code appended to the URL.
- https://yourRedirectUrl.com?code={{code}}

Then, using the generated code above send a POST request to https://pelcro.com/oauth/token to fetch your access token, which will be used to access our Core API services.

A sample of the payload :

{
	“grant_type” : “GENERATED_AUTORIZATION_CODE”,
	“client_id” : YOUR_CLIENT_ID,
	“client_secret” : “YOUR_CLIENT_SECRENT”,
	“redirect_uri” : “YOUR_REDIRECT_URI”,
	“code” : “YOUR_AUTHORIZATION_CODE”

}

A sample of the response will be:

{	
  “token_type”: “Bearer”,
	“expires_in”: 172800,
	“access_token”: “ACCESS_TOKEN”
}

Note: The access token is only valid for 2 days and will only be scoped to the account where the application credentials were created on.

API keys management

Statuses

API keys can have one of the following statuses:

Status	Description
Active	Key is active until it expires or is revoked.
Revoked	Key was revoked and can no longer be used.
Expiring soon	Key is still active, but will expire within the next 30 days.
Expired	Key has expired and can no longer be used.

Expiration

Once created, an API key is valid for a period of 2 years. You will automatically be informed by email 30 days before an API key reaches its expiry date, as well as when the expiry date has been reached.

For your convenience, the status for keys expiring within the next 30 days will be displayed as "Expiring soon", and the time of expiry is mentioned next to each of your API keys, under the "EXPIRY" column.

Revoking keys

You can revoke active API key access by choosing "Revoke" from the action menu next to the corresponding API key. When the API key is revoked, it can no longer grant access to Core API functionality, and any requests using it will fail.

Revoked API keys continue to remain on your API key list. If an API key is revoked manually, the revocation date will be shown on the informational tooltip next to the status tag for the corresponding API key.

Reactivating keys

You can reactivate revoked API key access by choosing "Reactivate" from the action menu next to the corresponding API key. When the API key is reactivated, access will be restored to Core API functionality.

Deleting keys

You can delete revoked API keys by choosing "Delete" from the action menu next to the corresponding API key. When the API key is deleted, it will disappear from the list and cannot be reinstated.