Requests

The Attlaz API is a JSON HTTP API. This page describes how requests are addressed and what responses look like.

Base URL

All API requests go to:

https://api.attlaz.com

Most endpoints are versioned and are addressed with the API version as the first path segment:

https://api.attlaz.com/{version}/{resource}

For example:

https://api.attlaz.com/1.13/pulse/catalogs/{catalogId}/products

A few endpoints are not versioned, notably the OAuth token endpoint (/oauth/token) — see Authentication.

Choosing an API version

The current version is 1.13. You can select a version in two ways:

• In the path, as shown above (/1.13/...).

• With a header, using Attlaz-API-Version. Besides explicit versions such as 1.13, the following aliases are accepted:

  Alias	Meaning
  latest	The newest available version
  stable	The latest stable version
  beta	The current beta version
  alpha	The current alpha version

Multiple API versions run at the same time, so existing integrations keep working when a new version is released. The changelog records what changed in each version.

Response format

Responses are JSON. Field names use snake_case, dates are ISO 8601 strings, and a reference to another entity is returned as that entity's id string (for example a product's project_id is returned as project).

A request for a single object returns that object directly as the response body:

{
  "id": "3Xr8k2...",
  "name": "Production",
  "project": "9aBc..."
}

A request for a collection returns a list envelope:

{
  "data": [
    { "id": "3Xr8k2...", "name": "Production" },
    { "id": "7Yh1p9...", "name": "Staging" }
  ],
  "has_more": true
}

has_more tells you whether more results are available — see Paginating results.

Errors

Errors return the appropriate HTTP status code and a body of the form:

{
  "error": {
    "code": "payload_too_large",
    "message": "request entity too large"
  }
}

The error object always contains a human-readable message, plus these fields where they apply:

• code — a stable, machine-readable identifier for the error. Prefer matching on it over the message, which can change. It is omitted when no specific code applies.
• param — the name of the offending request parameter, returned when a validation error concerns a specific field.

500 responses always return a generic message; the underlying detail is logged on our side and never included in the response.

Status	Meaning
400 Bad Request	The request was malformed — for example an invalid parameter or an invalid pagination cursor.
401 Unauthorized	The access token is missing or invalid. See Authentication.
403 Forbidden	The token is valid but does not have access to the requested resource.
404 Not Found	The resource does not exist.
413 Payload Too Large	The request body exceeds the endpoint's size limit.
500 Internal Server Error	An unexpected error occurred on our side.

Requests are also subject to rate limits; every response includes the current rate-limit headers.