Log in and get an ApiCode

Logs in with an API key and password and returns the ApiCode you send with every other request.

POST https://out.stockmount.com/api/User/DoLogin

You create the API key and password in the StockMount panel under Settings → API service settings. An account can have at most 2 keys. Only keys with active status can log in.

Send the returned ApiCode in the ApiCode field of the JSON body of every other request. It is an encrypted, opaque string and can contain +, / and =. Do not try to decode or modify it.

The session is valid for the period set in the system settings, counted from the last login with the same credentials (in minutes; default 1440 minutes = 24 hours). Service calls do not extend it. When it expires, requests return 00001 with "Your session has timed out, please refresh your ApiCode using 'DoLogin' service.". Then call DoLogin for a new ApiCode and retry the request.

If you call DoLogin again with the same credentials while the session is valid, the credentials are checked again, the same ApiCode is returned and the session period starts over. Every system that uses the same API key gets the same ApiCode. Store the ApiCode and reuse it; call DoLogin when you get 00001 or 00006, not before every request.

Each API key has its own session; logging in with one does not affect the ApiCode of another.

To log in, the account must be active and must have a valid package that gives API access: an unexpired paid or trial StockMount package, or an unexpired Out API service. If neither exists, the call returns 99988.

Wrong credentials, a passive account, a passive API key, a closed account and server maintenance all give the same result: 00001 with an empty ErrorMessage. The actual reason is not returned.

Request fields

Field	Type	Description
`ApiKey` required	string	The API key created in the panel.
`ApiPassword` required	string	The password of the API key.
`DeveloperId`	string	Optional. Free text that identifies your integration. It is stored with the session and used only for logging.

Response fields (Response)

Field	Type	Description
`UserId`	integer	Account ID.
`Name`	string	Account holder's first name.
`Surname`	string	Account holder's last name.
`Email`	string	Account e-mail address.
`Username`	string	Account username.
`Avatar`	string	Profile image. Can be empty.
`PackageEndDate`	datetime	Account package end date. ISO 8601 without a time zone offset (e.g. `2027-03-31T00:00:00`), in Türkiye time. When a stored session is returned, this is the value from the first login.
`ApiCode`	string	Session code. Send it in the `ApiCode` field of every other request.

Error codes for this endpoint

Code	When
`00003`	A required field is missing. `ErrorMessage` names it: `ApiKey` or `ApiPassword`. An empty body (`{}`) returns the `ApiKey` error.
`99988`	The account has no valid package or Out API service that gives API access. Messages: "Package can not be validated! Type: 2. Please purchase API package." (no service), "Package can not be validated! Please purchase API package." (service expired), "Package can not be validated! Type: 3." (package data could not be read).
`99999`	Unexpected server error. `ErrorMessage` contains the technical error text.

For session errors (00001, 00006) and every other code see error codes.

Related endpoints

Example request

{
  "ApiKey": "3f9c2a7e5b1d4c08",
  "ApiPassword": "Xk82!pQz7mWv",
  "DeveloperId": "ornek-erp-connector"
}

curl -X POST 'https://out.stockmount.com/api/User/DoLogin' \
  -H 'Content-Type: application/json' \
  -d '{
  "ApiKey": "3f9c2a7e5b1d4c08",
  "ApiPassword": "Xk82!pQz7mWv",
  "DeveloperId": "ornek-erp-connector"
}'

using System.Net.Http;
using System.Text;

using var http = new HttpClient();
var json = """
{
  "ApiKey": "3f9c2a7e5b1d4c08",
  "ApiPassword": "Xk82!pQz7mWv",
  "DeveloperId": "ornek-erp-connector"
}
""";

var response = await http.PostAsync(
    "https://out.stockmount.com/api/User/DoLogin",
    new StringContent(json, Encoding.UTF8, "application/json"));

var result = await response.Content.ReadAsStringAsync();
// Result == false ise ErrorCode ve ErrorMessage alanlarına bakın.
Console.WriteLine(result);

<?php
$body = <<<'JSON'
{
  "ApiKey": "3f9c2a7e5b1d4c08",
  "ApiPassword": "Xk82!pQz7mWv",
  "DeveloperId": "ornek-erp-connector"
}
JSON;

$ch = curl_init('https://out.stockmount.com/api/User/DoLogin');
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
    CURLOPT_POSTFIELDS => $body,
    CURLOPT_RETURNTRANSFER => true,
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);

if (!$result['Result']) {
    echo $result['ErrorCode'] . ' ' . $result['ErrorMessage'];
}

import requests

payload = {
    "ApiKey": "3f9c2a7e5b1d4c08",
    "ApiPassword": "Xk82!pQz7mWv",
    "DeveloperId": "ornek-erp-connector"
}

response = requests.post("https://out.stockmount.com/api/User/DoLogin", json=payload, timeout=60)
result = response.json()

if not result["Result"]:
    print(result["ErrorCode"], result["ErrorMessage"])

const payload = {
  "ApiKey": "3f9c2a7e5b1d4c08",
  "ApiPassword": "Xk82!pQz7mWv",
  "DeveloperId": "ornek-erp-connector"
};

const response = await fetch("https://out.stockmount.com/api/User/DoLogin", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify(payload),
});
const result = await response.json();

if (!result.Result) {
  console.error(result.ErrorCode, result.ErrorMessage);
}

Example response

{
  "Result": true,
  "Response": {
    "UserId": 104523,
    "Name": "Ayşe",
    "Surname": "Yılmaz",
    "Email": "ayse@ornekmagaza.com",
    "Username": "ornekmagaza",
    "Avatar": "",
    "PackageEndDate": "2027-03-31T00:00:00",
    "ApiCode": "q7XvT1kR9mN2bW4yL8pZ0cH5sJ3fG6dA+eU1iO7tY2rE9wQ4xV8nM0lK5jH3gF6d=="
  }
}

Try it

The request goes straight from your browser to out.stockmount.com. The ApiCode is not stored by this site; it is kept only while this tab is open.

Body (JSON)

{
  "ApiKey": "3f9c2a7e5b1d4c08",
  "ApiPassword": "Xk82!pQz7mWv",
  "DeveloperId": "ornek-erp-connector"
}