StoreBay API
A REST API and signed webhooks, included in the plan.
Build on StoreBay.
A REST API and signed webhooks, included in the plan.
StoreBay's REST API and HMAC-signed webhooks are included in the plan. You can read the catalogue, take reservations and orders, manage agreements and billing, and subscribe to a signed event stream.
Quickstart
1 · Get a key
The account owner creates keys in your StoreBay back office, in the developer settings. The
plaintext is shown once at creation and StoreBay stores only a SHA-256 hash. A sb_test_…
key works only with a test account: email hello@storebay.co.uk to
ask for one.
2 · Make your first call
Every /v1 request carries a Bearer credential. No operator_id anywhere — your key already
resolves to exactly one operator.
curl https://api.storebay.co.uk/v1/sites \
-H "Authorization: Bearer sb_test_…"{
"data": [
{
"id": "018f9c2a-7b3e-7c1a-9f2d-3a5b6c7d8e9f",
"object": "site",
"name": "Attercliffe",
"timezone": "Europe/London",
"status": "active"
}
],
"meta": { "limit": 25, "cursor": { "next": null, "has_more": false } }
}Every response is one of exactly two shapes: { data, meta } on success, or a single error
object — never both. See Conventions.
3 · Subscribe to webhooks
Register an endpoint and StoreBay POSTs signed, versioned events (agreement.signed,
invoice.paid, payment.succeeded, …) as they happen. See
Webhooks.
Note
Every key is test or live, and works only with an account of the same kind: a sb_test_… key
with a test account, a sb_live_… key with a live one.
Warning
Never embed a key in a browser, mobile app, or any client you don't control — treat it like a password.
Where to go next
Authentication
Credential types, scopes, and environment-binding.
API reference
Every /v1 endpoint, generated from the OpenAPI spec — request/response schemas and try-it.
Webhooks
Register an endpoint, verify signatures, and handle retries.
Build a booking flow
From an empty basket to an active, billing licence — in eight calls.
Sandbox
A separate test account, set up by us on request, with identical isolation and events.
Changelog
What's new, what's deprecated, and whether it affects your integration.
The v1 surface
Every list endpoint is cursor-paginated and returns the { data, meta } envelope; every mutation
accepts an Idempotency-Key. Money is always integer minor units (3300 = £33.00) with an
ISO-4217 currency; IDs are UUIDv7 strings; the storage agreement is always a licence, never a
lease.
| Domain | Resources |
|---|---|
| Catalogue | sites, unit types, units, availability |
| Commerce | contacts, reservations, orders, agreements, subscriptions |
| Billing | invoices, credit notes, payments, payment methods, mandates |
| Products & pricing | products, coverage products, coupons, rate plans, price rules — see the sidebar's "Products & Pricing" reference group |
| CRM | deals, tasks, notes |
| Compliance | contracts, identity verifications |
| Access | access credentials, access events, hardware devices (no access vendor is connected yet) |
| Platform | webhooks, events, reports, imports |
Not every resource has a hand-written guide yet — the API reference
is generated straight from openapi.yaml and is always the source of truth for shapes, and the
list grows additively (see the Changelog).