Connect to the
SmartBamboo POS API

The API lives behind one GraphQL endpoint. We hand you three values at onboarding — keep the key secret and out of client-side code.

Authentication is two-tier. The API key gets you to the public endpoints; logging in returns a short-lived JWT that unlocks everything else. Pick the header that matches what you're calling.

Step 1 — Exchange credentials for a token

Call login with the API key in the header. It returns a JWT valid for roughly 24 hours, plus the signed-in user and company.

mutation Login {
  login(
    serverUrl: "https://odoo.smartbamboo.mx"
    database:  "production"
    username:  "partner@example.com"
    password:  "••••••••"
  ) {
    token           # put this in authorizationToken
    user {
      id
      name
      email
      company { id name }
    }
  }
}

Step 2 — Send the token on protected calls

From here on, set authorizationToken to the JWT. The API key is no longer needed for these requests.

Step 3 — Refresh before it expires

Call refreshToken with a still-valid token to get a fresh one — no need to re-enter credentials.

mutation Refresh {
  refreshToken { token }
}

Every call — query or mutation — is a single POST with a JSON body containing query and optional variables. Here's a complete authenticated request over curl.

curl -X POST "$ENDPOINT" \
  -H "authorizationToken: $JWT" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "query Products($q: String!) { getProducts(search: $q) { id name listPrice } }",
    "variables": { "q": "almohada" }
  }'

A successful response wraps results under data, keyed by the operation name:

{
  "data": {
    "getProducts": [
      { "id": 5659, "name": "Almohada Memory", "listPrice": 499.00 }
    ]
  }
}

Run real queries against the endpoint right here. Open the Headers tab in the explorer and add x-api-key (for public operations) or authorizationToken (for everything else), then hit run. The full schema loads by introspection once your headers are accepted.

Powered by Apollo's embedded Explorer. Nothing you type here is stored on this page.

The API exposes queries for reading and mutations for writing. Below are the operations most external integrations use. The full schema is browsable in the explorer above and available on request.

Queries — read data

Mutations — write data

The shapes you'll read most often. Fields shown are the common ones — request only what you need; GraphQL returns exactly the fields you select.

type Product {
  id: Int!
  name: String!
  defaultCode: String      # internal reference / SKU
  barcode: String
  listPrice: Float
  qtyAvailable: Float      # store-scoped stock
  categ: Category
}

type Partner {
  id: Int!
  name: String!
  email: String
  phone: String
  vat: String             # tax id (RFC)
}

type Order {
  id: Int!
  reference: String        # pos reference
  partner: Partner
  dateOrder: String
  amountTotal: Float
  state: String            # draft · paid · done · invoiced
  lines: [OrderLine]
}

type OrderLine {
  productId: Int!
  productName: String
  qty: Float
  priceUnit: Float
  discount: Float
  priceSubtotalIncl: Float  # tax-inclusive subtotal
}

Field names follow GraphQL camelCase. Money is decimal Float; prices on order lines are tax-inclusive unless noted.

The HTTP status is almost always 200 — GraphQL reports problems in an errors array alongside (or instead of) data. Always check for errors before trusting data.

{
  "errors": [
    { "message": "Not Authorized to access getProducts" }
  ]
}

A small REST surface exists for backward compatibility. Prefer GraphQL for new work — these routes will not gain features. Base URL: https://<id>.execute-api.<region>.amazonaws.com/<env>.