ECOSIRE 开发者门户

Q: 我如何获得 API 访问权限？

注册 ECOSIRE 帐户并导航至仪表板 > API 密钥以生成您的 API 凭证。所有计划均提供 API 访问权限。

使用我们全面的 REST API 构建强大的集成。 818+ 端点、完整的 OpenAPI 规范和 TypeScript SDK。

查看API文档获取API密钥

818+

API端点

模块

REST

建筑

支持的区域设置

API

快速入门

只需几分钟即可启动并运行 ECOSIRE API

认证

通过 Authentik 或 API 密钥使用 OAuth2 来获取用于 API 访问的 JWT 不记名令牌。

POST /api/auth/login

拨打您的第一个电话

使用授权标头中的不记名令牌来调用任何 API 端点。

# 列出所有联系人

curl -H "Authorization: Bearer $TOKEN" \

https://api.ecosire.com/api/contacts

调用公开端点

应用目录是开放的：无需密钥，也无需安装任何东西。任何 HTTP 客户端都可以使用。

const res = await fetch(

"https://api.ecosire.com/api/apps/platforms"

);

const platforms = await res.json();

57 Modules

API模块

探索涵盖企业运营各个方面的 57 个模块

核心

AuthUsersContactsProductsOrdersProjectsSettings

金融

AccountingSalesPurchaseBillingInvoicing

运营

InventoryManufacturingPOSRentalPlanning

人力资源

EmployeesRecruitmentTime OffAttendanceExpensesPayrollAppraisals

营销与发展

Email MarketingEventsMarketing AutomationAnalyticsAffiliatesLoyalty

人工智能与自动化

ECOSIRE AISelf-Evolving EngineContent GenerationSEO Scanner

Security

认证

两种身份验证方法可满足您的集成需求

仅 Http Cookie

浏览器应用程序基于 cookie 的安全身份验证。令牌永远不会暴露给 JavaScript。

通过网络应用程序自动完成
HttpOnly、安全、SameSite=Lax
7 天刷新代币轮换

不记名令牌

使用 JWT 不记名令牌进行服务器到服务器集成和 API 客户端。

// Authorization header

Authorization: Bearer <your_jwt_token>

// Or via HttpOnly cookie

Cookie: ecosire_auth=<token>

Interactive

API Playground

Try any endpoint directly from your browser. Select an endpoint, fill in parameters, and send live requests to the ECOSIRE API.

ECOSIRE API Playground

api.ecosire.com/api

POST/auth/login

Authorization

Request Body (JSON)

https://api.ecosire.com/api/auth/login

Code Snippet

curl -X POST \ \
  "https://api.ecosire.com/api/auth/login" \ \
  -H "Content-Type: application/json" \
  -d '{   "email": "user@example.com",   "password": "secret" }'

HTTP

HTTP 代码示例

无需安装任何东西。使用你的编程语言自带的 HTTP 客户端调用 API——下面的每个请求都可以直接在线上 API 运行。

代码示例

目录、许可证和智能体工具——提供 curl、TypeScript、Python、PHP 和 Ruby 版本

1. 列出平台

应用目录中的所有平台，以及每个平台收录的应用数量和今天即可安装的应用数量。无需密钥。

curl -s "https://api.ecosire.com/api/apps/platforms" \
  -H "User-Agent: my-integration/1.0"

# 200 OK — no key needed
# [
#   { "platform": "odoo", "slug": "odoo", "label": "Odoo",
#     "appCount": <apps listed>, "sellableCount": <ready to install today> },
#   ...
# ]

Webhooks

Webhook Events

ECOSIRE sends real-time webhook events to your server when key actions occur — payments, subscriptions, license activations, and more.

Webhook Event Tester

Explore all 8 webhook events, generate cURL commands, and verify HMAC signatures.

Select Webhook Event

Your Webhook URL (optional)

Checkout Completed

checkout.session.completed

Fired when a customer completes payment in a Stripe Checkout Session.

Trigger: Customer pays for a product in the storefront. Auto-grants licenses and creates order.

Example JSON payload delivered to your webhook endpoint for checkout.session.completed.

json

{
  "id": "evt_1ABCxyz",
  "object": "event",
  "type": "checkout.session.completed",
  "created": 1711000000,
  "data": {
    "object": {
      "id": "cs_live_abc123",
      "object": "checkout.session",
      "customer_email": "customer@company.com",
      "amount_total": 24900,
      "currency": "usd",
      "mode": "payment",
      "payment_status": "paid",
      "metadata": {
        "userId": "usr_01HXYZ",
        "productIds": "[\"prd_01HODOOCRM\"]"
      }
    }
  }
}

All Webhook Events

Event	Trigger	Fields
`checkout.session.completed` Checkout Completed	Customer pays for a product in the storefront. Auto-grants licenses and creates order.	7 fields
`invoice.paid` Invoice Paid	Monthly/annual subscription renewal is processed. Reactivates suspended licenses and logs billing record.	6 fields
`customer.subscription.deleted` Subscription Cancelled	Subscription period ends and cancel_at_period_end was true, or immediate cancellation was requested. Suspends all associated licenses.	5 fields
`customer.subscription.updated` Subscription Updated	Customer changes their plan, payment fails and subscription pauses, or subscription resumes after payment. Syncs license status accordingly.	5 fields
`charge.refunded` Charge Refunded	Admin or customer initiates a refund via Stripe Dashboard or API. Revokes associated licenses and marks the order as refunded.	5 fields
`payment_intent.payment_failed` Payment Failed	Subscription renewal fails or one-time payment is declined. Marks order as payment_failed and sends failure notification email.	5 fields
`license.validated` License Validated	Odoo module calls POST /licenses/validate on server startup. Used for audit logging and anomaly detection.	5 fields
`license.activated` License Activated	First time POST /licenses/activate is called for a domain. Logs the activation for audit and security monitoring.	5 fields

Verify webhook signatures in production

Always verify the stripe-signature header for Stripe events using your STRIPE_WEBHOOK_SECRET. For license events, verify the X-License-Signature header using ECOSIRE_LICENSE_SECRET. Unverified events should be rejected with 401.

Reference

Error Codes

All API errors follow RFC 7807 (Problem Details for HTTP APIs). Every error includes a machine-readable code and human-readable message.

Status	Meaning	When it occurs
200	OK	Successful GET or POST returning data
201	Created	Successful resource creation (POST)
204	No Content	Successful DELETE or PUT with no body
400	Bad Request	Invalid request body, missing required fields, or malformed JSON
401	Unauthorized	Missing, expired, or invalid JWT token
403	Forbidden	Valid token but insufficient role (e.g. requires admin)
404	Not Found	Resource does not exist or has been deleted
409	Conflict	Duplicate resource — email already registered, license already active
422	Unprocessable	Validation failed — Zod schema rejection with field-level details
429	Too Many Requests	Rate limit exceeded — see Retry-After header
500	Server Error	Unexpected server error — stack trace hidden in production

Error Response Shape

{
  "statusCode": 422,
  "error": "Unprocessable Entity",
  "message": "Validation failed",
  "details": [
    { "field": "email", "message": "Invalid email address" },
    { "field": "password", "message": "Must be at least 8 characters" }
  ]
}

Rate Limits

速率限制

公平的使用限制，确保所有用户的 API 稳定性

端点	速率限制
POST /support	5/min
POST /crm/capture	10/min
POST /ecosire-ai/ask	20/min
POST /licenses/validate	30/min
POST /licenses/activate	10/min
POST /newsletter/subscribe	5/min
Authenticated endpoints	100/min

Rate Limit Response Headers

X-RateLimit-LimitMaximum requests allowed in the window

X-RateLimit-RemainingRequests remaining in the current window

X-RateLimit-ResetUnix timestamp when the window resets

Retry-AfterSeconds to wait before retrying (on 429)

SDK

资源&SDK

构建集成所需的一切

API 参考

基础 URL、速率限制、响应格式以及各模块的端点，并附有请求和响应示例。

打开文档

身份验证指南

如何使用 API 密钥或 JWT Bearer 令牌进行身份验证，以及安全最佳实践。

打开文档

错误参考

HTTP 状态码、错误响应格式、常见错误场景以及错误处理最佳实践。

打开文档

API Keys

API Key Management

Create and manage API keys from your dashboard. Each key can be scoped to specific permissions and rotated independently.

Create API Keys

Generate new API keys from Dashboard → Settings → API Keys. Each key has a name, optional expiry date, and role scope.

Scoped Permissions

Keys can be scoped to read-only, read-write, or admin. Admin keys can manage other keys and access all endpoints.

Key Rotation

Rotate keys at any time without downtime. The old key remains valid for 24 hours after rotation for a smooth transition.

Usage Analytics

View per-key request counts, error rates, and last-used timestamps from the API Keys dashboard page.

Environment Keys

Maintain separate keys for development, staging, and production. Production keys log all requests for audit purposes.

Webhook Secrets

Webhook endpoints also use a separate ECOSIRE_LICENSE_SECRET for HMAC-SHA256 signature verification on license events.

Using an API Key

# Pass the key as a Bearer token in the Authorization header
curl https://api.ecosire.com/api/contacts \
  -H "Authorization: Bearer ecos_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

# Or use HttpOnly cookies (browser-based auth — set automatically on login)
# Cookie: ecosire_auth=<jwt_token>

FAQ

常见问题解答

有关 ECOSIRE API 的常见问题

我如何获得 API 访问权限？

有免费套餐吗？

是的，所有 ECOSIRE 帐户都包含 API 访问权限。费率限制因计划而异。免费套餐每天支持最多 1,000 个 API 调用。

支持哪些身份验证方法？

我们通过 Authentik（推荐用于 Web 应用程序）、JWT 不记名令牌（用于服务器到服务器）和 API 密钥（用于简单集成）支持 OAuth2。

你们有网络钩子支持吗？

是的，ECOSIRE 支持用于实时事件通知的 Webhooks。在仪表板 > 设置 > Webhooks 中配置 Webhook 端点。

API 正常运行时间 SLA 是什么？

我们不公布正常运行时间百分比，而是公开其背后的系统。API 以多实例冗余集群运行并配有健康检查，发布采用零停机重载而非重启，实时服务状态和事件历史可在 status.ecosire.com 查看。事件的响应承诺写在您的支持协议中，而不是一个营销数字里。

准备好构建了吗？

获取您的 API 密钥并在几分钟内开始构建集成。

获取API密钥查看文档