Getting started

Authentication

You open a session in the Out API with DoLogin, using the API key and password you create in the panel. Send the returned ApiCode in the JSON body of every other request.

Creating an API key

Log in to the StockMount panel and open the API service settings screen in the Settings menu.
Enter a description you will recognise and create a new key. The screen shows the ApiKey and ApiPassword values.
Store both values in your integration's server-side settings.

An account can have up to 2 API keys.
Only keys with an active status can log in.
Editing an existing key renews its API password; update the password in your integration too.

The DoLogin request

Request body:

{
  "ApiKey": "YOUR_API_KEY",
  "ApiPassword": "YOUR_API_PASSWORD"
}

You can put a name that identifies your integration in the optional DeveloperId field (for example example-erp). It is only used in logs. A successful response:

{
  "Result": true,
  "Response": {
    "UserId": 104523,
    "Name": "Jane",
    "Surname": "Doe",
    "Email": "jane@example-store.com",
    "Username": "examplestore",
    "PackageEndDate": "2027-03-31T00:00:00",
    "ApiCode": "q7XvT1kR9mN2bW4y…"
  }
}

Using the ApiCode

Add the ApiCode to the body of every other request as the ApiCode field. Credentials in HTTP headers (Authorization and so on) are ignored.

{
  "ApiCode": "q7XvT1kR9mN2bW4y…",
  "IntegrationId": 2
}

The ApiCode is an encrypted, opaque string and may contain +, / and =. Store and send it exactly as received.

Session lifetime and renewal

A session is valid for a limited time from the last login with the same credentials (24 hours by default). Service calls do not extend it.
When it expires, requests return Result: false with ErrorCode: "00001" (00006 for a malformed code). Get a new ApiCode with DoLogin and retry the request once.
Do not call DoLogin before every request. Logging in again with the same credentials while the session is valid returns the same ApiCode and starts the session period over.
Each API key has its own session. Systems using the same key get the same ApiCode; different keys do not affect each other's ApiCode.

Login errors

Code	Meaning
`00003`	A required field is missing. `ErrorMessage` names the field.
`00001`	Login failed. Wrong credentials, a passive account and a passive key all return this code; no detail is given for security reasons.
`99988`	The account has no valid package that includes API access. Check your package in the panel.

Security tips

Keep the API key, password and ApiCode on the server side only. Do not embed them in browser code or mobile apps.
Do not write them to logs, error reports or support tickets.
If you think a key has leaked, deactivate or delete it in the panel and create a new one.
A separate key per integration makes it easier to see which one is affected when something goes wrong.