Overview
Base URL, the two anonymous endpoints and the ground rules of the WinShop Web API.
Base URL
Every customer has their own WinShop instance with its own host name. All examples on this site use the placeholder https://<your-instance>; replace it with the address you receive from WinShop support together with your credentials.
- The API is served over HTTPS only.
- Every API route starts with
/api/, for examplehttps://<your-instance>/api/products/42. - The token endpoint is the one exception: it lives at
/connect/token. See Authentication. - Requests and responses are JSON only. Send
Content-Type: application/jsonon requests with a body. A few endpoints return a file instead, such as a document rendered as PDF.
Check that the instance is up
GET /api/health needs no token. It returns 200 with the plain text Healthy when the instance is running. Use it for connectivity tests and uptime monitoring.
curl https://<your-instance>/api/healthHTTP/1.1 200 OK
Content-Type: text/plain
HealthyThe health check is not part of the OpenAPI description, so you will not find it in the reference. This page is its documentation.
Check which version it runs
GET /api/version also needs no token. It returns the release version of the instance.
curl https://<your-instance>/api/version{
"version": "2026.10",
"product": "WinShop Web API"
}Available from the next API release
Instances on an older release do not have this endpoint and answer 404. If you get 404, ask WinShop support which
release the instance runs.
Compare the value with the changelog to learn which endpoints and fields your instance has.
Everything else needs a token
All other endpoints require an OAuth 2.0 access token in the Authorization header:
curl https://<your-instance>/api/item-lists/warehouses \
-H "Authorization: Bearer $ACCESS_TOKEN"