Skip to content
Linra Omni Vendor Docs

Generate a new API credential for yourself

POST
/api/v1/credentials
curl --request POST \
  --url https://api-omni-vendors.linra.net/api/v1/credentials \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "capabilities": "Offers, Cost" }'

Generates a new capability-scoped credential for your vendor in the environment named by the required X-Linra-Environment header. The secret is returned once and never again. The requested capabilities may never exceed the UNION of what your OTHER active credentials already hold (across every environment) — a superset request is rejected (403 FORBIDDEN_CAPABILITY_NOT_GRANTED_TO_VENDOR); if you have zero active credentials anywhere, this is rejected too (422 BUSINESS_VENDOR_FIRST_CREDENTIAL_REQUIRES_ONBOARDING) — your very first credential is always issued by Linra during onboarding. Requires the Account capability.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

Deliberately carries ONLY capabilities — the target vendor is always you (SCOPE-01), and the union-cap enforcement (VENDOR-04) is always on for this door.

object
capabilities
required

A comma-separated combination of one or more granted capabilities: Offers, Stock, Cost, Orders, Account. Account gates the Profile-update and Credentials-write endpoints on this document; the other four gate the commercial (Offers/Cost/Stock/Orders/Webhooks) endpoints as documented on each operation.

string
Example
Offers, Cost

Responses

Section titled “Responses”

201

Section titled “201”

The created credential, with its one-time secret.

Media typeapplication/json
object
state
required
string
payload
required
details
object
payload
required
object
id
string format: uuid
environment
string
clientId
string
nullable
clientSecret

Shown EXACTLY ONCE — no other read ever returns it.

string
nullable
capabilities

A comma-separated combination of one or more granted capabilities: Offers, Stock, Cost, Orders, Account. Account gates the Profile-update and Credentials-write endpoints on this document; the other four gate the commercial (Offers/Cost/Stock/Orders/Webhooks) endpoints as documented on each operation.

string
createdAt
string format: date-time
Example
{
  "state": "SUCCESS",
  "payload": {
    "environment": "Production",
    "capabilities": "Offers, Cost"
  }
}

400

Section titled “400”

Request validation failed.

Media typeapplication/json
object
state
required
string
payload
details
object
Example
{
  "state": "NOT_FOUND_VENDOR_OFFER"
}

403

Section titled “403”

Missing the Account capability, or the requested capabilities exceed the union already authorized for your vendor.

Media typeapplication/json
object
state
required
string
payload
details
object
Examples
{
  "state": "FORBIDDEN_CAPABILITY_NOT_GRANTED",
  "payload": null,
  "details": {
    "requiredCapability": "Account"
  }
}

422

Section titled “422”

You have zero active credentials in any environment — your first credential must come from Linra onboarding.

Media typeapplication/json
object
state
required
string
payload
details
object
Examples
ExamplefirstCredential
{
  "state": "BUSINESS_VENDOR_FIRST_CREDENTIAL_REQUIRES_ONBOARDING",
  "payload": null,
  "details": {}
}

429

Section titled “429”

Too many requests. Retry after the Retry-After header (seconds).

Media typeapplication/json
object
state
required
string
payload
details
object
Example
{
  "state": "NOT_FOUND_VENDOR_OFFER"
}

Headers

Section titled “Headers”
Retry-After
integer

Seconds to wait before retrying.