StoreBay API
An open REST API, signed webhooks, and a free sandbox — included in every plan.
Build on StoreBay.
An open REST API, signed webhooks, and a free sandbox — included in every plan.
StoreBay ships a public REST API, HMAC-signed webhooks, and a sandbox from launch, all included in the standard plan — not gated behind a premium tier. Read the catalogue, take reservations and orders, manage agreements and billing, orchestrate smart-entry access, and subscribe to a signed event stream.
Quickstart
1 · Get a key
Generate an API key in your StoreBay developer settings (https://app.storebay.co.uk). The
plaintext is shown once at creation — StoreBay stores only a SHA-256 hash. Use a sb_test_…
key while you build; nothing you do in test mode touches real money.
2 · Make your first call
Every /v1 request carries a Bearer credential. No operator_id anywhere — your key already
resolves to exactly one operator.
curl https://api.storebay.co.uk/v1/sites \
-H "Authorization: Bearer sb_test_…"{
"data": [
{
"id": "018f9c2a-7b3e-7c1a-9f2d-3a5b6c7d8e9f",
"object": "site",
"name": "Attercliffe",
"timezone": "Europe/London",
"status": "active"
}
],
"meta": { "limit": 25, "cursor": { "next": null, "has_more": false } }
}Every response is one of exactly two shapes: { data, meta } on success, or a single error
object — never both. See Conventions.
3 · Subscribe to webhooks
Register an endpoint and StoreBay POSTs signed, versioned events (agreement.signed,
invoice.paid, payment.succeeded, …) the moment they happen — far better than polling. See
Webhooks.
Note
Every key is test or live — build against sb_test_…, then swap to sb_live_… to go live.
Warning
Never embed a key in a browser, mobile app, or any client you don't control — treat it like a password.
Where to go next
Authentication
Credential types, scopes, and environment-binding.
API reference
Every /v1 endpoint, generated from the OpenAPI spec — request/response schemas and try-it.
Webhooks
Register an endpoint, verify signatures, and handle retries.
Build a booking flow
From an empty basket to an active, billing licence — in eight calls.
Sandbox
A free test operator with identical isolation and events — no real money ever moves.
Changelog
What's new, what's deprecated, and whether it affects your integration.
The v1 surface
Every list endpoint is cursor-paginated and returns the { data, meta } envelope; every mutation
accepts an Idempotency-Key. Money is always integer minor units (3300 = £33.00) with an
ISO-4217 currency; IDs are UUIDv7 strings; the storage agreement is always a licence, never a
lease.
| Domain | Resources |
|---|---|
| Catalogue | sites, unit types, units, availability |
| Commerce | contacts, reservations, orders, agreements, subscriptions |
| Billing | invoices, credit notes, payments, payment methods, mandates |
| Products & pricing | products, coverage products, coupons, rate plans, price rules — see the sidebar's "Products & Pricing" reference group |
| CRM | deals, tasks, notes |
| Compliance | contracts, identity verifications |
| Access | access credentials, access events, hardware devices |
| Platform | webhooks, events, reports, imports |
Not every resource has a hand-written guide yet — the API reference
is generated straight from openapi.yaml and is always the source of truth for shapes, and the
list grows additively (see the Changelog).