The Smooth POS API gives you the same data you see in Smooth POS: sales, customers, products, inventory, accounts and more. Use it to sync your online store, feed your accounting system, or build your own reports.

This page gets you from zero to your first request. Each endpoint has its own page in the sidebar.

Base URL

Send every request to:

https://api.smoothpos.net

Every path ends in .json, including single-record lookups. Use /sales.json for a list and /sale/1234.json for one sale. Leave off the .json and you'll get {"error": "no route"}.

Get your API token

In Smooth POS, go to Admin → Users → API Users.
Create an API user and copy the token it generates.

Treat the token like a password. Anyone who has it can read and change your data, so keep it out of client-side code and public repos.

Authenticate

Send your token in the X-Smoothpos-Auth header on every request:

X-Smoothpos-Auth: YOUR_TOKEN

Your first request

List your stores to check everything's wired up:

curl https://api.smoothpos.net/stores.json \
  -H "X-Smoothpos-Auth: YOUR_TOKEN"

You'll get back a JSON array like this:

[
  {
    "id": 79,
    "name": "Main Store",
    "time_zone": "Australia/Sydney",
    "warehouse_id": 99,
    "closed": false,
    "created": "2023-08-06T03:42:44Z",
    "updated": "2026-07-12T02:56:18Z"
  }
]

(Trimmed: each store also includes its address and warehouse.)

If you see {"error": "not authorised"} instead, check your token (see Errors).

Sending data

For POST and PUT requests, send a JSON body with the header Content-Type: application/json.

Dates and times

Timestamps such as created and updated come back in ISO 8601 UTC, for example 2026-09-12T08:12:48Z. Date filters accept either a date (2026-09-01) or a full timestamp (2026-09-01T00:00:00Z).

🚧
An invalid date in a filter doesn't raise an error. You'll just get an empty list, so double-check your format if a query unexpectedly returns nothing.

You might see 0001-01-01T00:00:00Z on some fields, such as local_created. That means "not set".

Paging through lists

List endpoints return a plain JSON array and use cursor paging:

limit sets the page size. The default is 50 and the maximum is 250. If you ask for more, you'll get 250.
When there's another page, the response includes an X-Next-Page header holding the path and query for the next page, including a cursor. Request that path to continue.
From the second page on, there's also an X-Prev-Page header.
When X-Next-Page is missing, you've reached the last page.

curl -i "https://api.smoothpos.net/sales.json?limit=100" \
  -H "X-Smoothpos-Auth: YOUR_TOKEN"
# HTTP/2 200
# x-next-page: /sales.json?limit=100&cursor=eyJwayI6...

Lists come back oldest first (ascending id) unless you sort them. On endpoints that support sorting, such as /sales.json, pass sort_field and sort together (e.g. sort_field=created&sort=desc). sort on its own is ignored.

Filtering

Most list endpoints take filters as query parameters. Pass arrays as comma-separated values, e.g. ?ids=1152264,1157926.

Unknown parameters are silently ignored, so a typo in a filter name gives you unfiltered results rather than an error.

Errors

Every error comes back as JSON with a single error message:

{ "error": "sale not found" }

Status	`error` message	What it means	What to do
`200`	—	It worked.	Nothing to do.
`404`	`not authorised`	Your token is missing or invalid. Heads up: this is a 404, not a 401.	Check the `X-Smoothpos-Auth` header and that the API user still exists.
`404`	`no route`	That path doesn't exist. Usually it's a missing `.json` or a non-numeric ID.	Check the path.
`404`	`<thing> not found`, e.g. `sale not found`	There's no record with that ID.	Check the ID.
`404`	`no <things> found`, e.g. `no journals found`	Some list filters return a 404 rather than an empty array when nothing matches.	Treat it as "no results".