FORTIS API:Public API
Public API for external consumers. Exposes catalog resources (categories and goods with variations), completed sales, point-of-sale terminal information, and employees.
Authentication: Bearer or other credentials are validated at the API gateway. Company scope
and authorization are derived from gateway context after successful authentication. Do not send a
separate company_id query parameter unless the gateway contract explicitly adds it.
Environment: Production is the only environment available to external consumers — there is no
public sandbox, dev, QA or preprod. Every request goes over HTTPS to the single base URL
https://api.fortis.world/api/v1; the /api/v1 prefix is part of the base URL, and all paths in this
document are relative to it. Full URL examples:
POST https://api.fortis.world/api/v1/auth/tokens
GET https://api.fortis.world/api/v1/sales?status=completed
GET https://api.fortis.world/api/v1/sales/{sale_id}
GET https://api.fortis.world/api/v1/business-structure/point-of-sales
GET https://api.fortis.world/api/v1/catalog/goods/regular
Varied catalog items: Goods with multiple sellable configurations (including those managed as optioned
in internal/backoffice systems) are returned on /catalog/goods/regular as items with a variations
array — the same shape as other multi-variation goods; there is no separate optioned resource type in this API.
Authentication
- HTTP: Bearer Auth
JWT access token issued by the public authorization endpoints
(POST /auth/tokens / POST /auth/tokens/refresh). Pass it as
Authorization: Bearer <access_token>. Required for all operations
except the two OAuth2 token endpoints, which are public.
Security Scheme Type: | http |
|---|---|
HTTP Authorization Scheme: | bearer |
Bearer format: | JWT |
License
Proprietary