Create Order

POST /orders

Get Order

GET /orders/:id

:id may be either the Tijar Suite order id or the externalOrderId you created it with.

Update Order

PATCH /orders/:id

Accepts the same fields as Create Order, all optional — only fields you include are changed. externalOrderId and the order type cannot be changed once set. Changing orderStatus to a different value triggers an order.status_changed webhook (see Webhooks, below) in addition to order.updated.

Available events

Payload

Every delivery is a JSON POST with this envelope:

Envelope{
  "id": "evt_cjk3x8f2a0001qs08a1b2c3d4",
  "type": "order.created",
  "createdAt": "2026-10-01T09:12:00.000Z",
  "data": { ... }
}

data{
  "id": "order_id",
  "externalOrderId": "your-order-123",
  "status": "PENDING",
  "orderTotal": 1250,
  "recipientName": "Jane Doe",
  "recipientPhone": "01700000000",
  "itemCount": 2,
  "updatedAt": "2026-10-01T09:12:00.000Z"
}

data{
  ...same fields as above,
  "previousStatus": "PENDING",
  "newStatus": "CONFIRMED"
}

inventory.stock_changed — data{
  "id": "inventory_item_id",
  "sku": "TS-SHIRT-01",
  "size": "M",
  "previousStock": 20,
  "newStock": 15,
  "quantityChanged": -5,
  "reason": "Order #1234"
}

HMAC signature & verification

Retry behavior

Test your connection

cURLcurl https://tijarsuite.tech/api/v1/ping \
  -H "X-Api-Key: tsk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "X-Api-Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Node.js (fetch)const res = await fetch('https://tijarsuite.tech/api/v1/ping', {
  headers: {
    'X-Api-Key': process.env.TIJAR_API_KEY,
    'X-Api-Secret': process.env.TIJAR_API_SECRET,
  },
});
const json = await res.json();
console.log(json); // { success: true, data: { message: 'Connection successful', requestId: '...' } }

PHP (cURL)$ch = curl_init('https://tijarsuite.tech/api/v1/ping');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'X-Api-Key: ' . getenv('TIJAR_API_KEY'),
        'X-Api-Secret: ' . getenv('TIJAR_API_SECRET'),
    ],
]);
$response = json_decode(curl_exec($ch), true);
curl_close($ch);
print_r($response);

Create an order

cURLcurl -X POST https://tijarsuite.tech/api/v1/orders \
  -H "X-Api-Key: tsk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "X-Api-Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: order-123-attempt-1" \
  -d '{
    "externalOrderId": "order-123",
    "customer": { "name": "Jane Doe", "phone": "01700000000" },
    "shipping": { "address": "123 Road", "city": "Dhaka", "zone": "Gulshan", "area": "Gulshan 1" },
    "items": [
      { "sku": "TS-SHIRT-01", "quantity": 2, "unitPrice": 850 }
    ],
    "orderTotal": 1700,
    "paymentStatus": "unpaid"
  }'

Node.js (fetch)const res = await fetch('https://tijarsuite.tech/api/v1/orders', {
  method: 'POST',
  headers: {
    'X-Api-Key': process.env.TIJAR_API_KEY,
    'X-Api-Secret': process.env.TIJAR_API_SECRET,
    'Content-Type': 'application/json',
    'Idempotency-Key': 'order-123-attempt-1',
  },
  body: JSON.stringify({
    externalOrderId: 'order-123',
    customer: { name: 'Jane Doe', phone: '01700000000' },
    shipping: { address: '123 Road', city: 'Dhaka', zone: 'Gulshan', area: 'Gulshan 1' },
    items: [{ sku: 'TS-SHIRT-01', quantity: 2, unitPrice: 850 }],
    orderTotal: 1700,
    paymentStatus: 'unpaid',
  }),
});
const order = await res.json();

PHP (cURL)$body = [
    'externalOrderId' => 'order-123',
    'customer' => ['name' => 'Jane Doe', 'phone' => '01700000000'],
    'shipping' => ['address' => '123 Road', 'city' => 'Dhaka', 'zone' => 'Gulshan', 'area' => 'Gulshan 1'],
    'items' => [['sku' => 'TS-SHIRT-01', 'quantity' => 2, 'unitPrice' => 850]],
    'orderTotal' => 1700,
    'paymentStatus' => 'unpaid',
];

$ch = curl_init('https://tijarsuite.tech/api/v1/orders');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($body),
    CURLOPT_HTTPHEADER => [
        'X-Api-Key: ' . getenv('TIJAR_API_KEY'),
        'X-Api-Secret: ' . getenv('TIJAR_API_SECRET'),
        'Content-Type: application/json',
        'Idempotency-Key: order-123-attempt-1',
    ],
]);
$order = json_decode(curl_exec($ch), true);
curl_close($ch);

List inventory

cURLcurl "https://tijarsuite.tech/api/v1/inventory?page=1&limit=50&category=Shirts" \
  -H "X-Api-Key: tsk_live_xxxxxxxxxxxxxxxxxxxx" \
  -H "X-Api-Secret: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"

Node.js (fetch)const url = new URL('https://tijarsuite.tech/api/v1/inventory');
url.searchParams.set('page', '1');
url.searchParams.set('limit', '50');

const res = await fetch(url, {
  headers: {
    'X-Api-Key': process.env.TIJAR_API_KEY,
    'X-Api-Secret': process.env.TIJAR_API_SECRET,
  },
});
const { data } = await res.json();
console.log(data.items, data.total, data.pages);

PHP (cURL)$ch = curl_init('https://tijarsuite.tech/api/v1/inventory?page=1&limit=50');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'X-Api-Key: ' . getenv('TIJAR_API_KEY'),
        'X-Api-Secret: ' . getenv('TIJAR_API_SECRET'),
    ],
]);
$result = json_decode(curl_exec($ch), true);
curl_close($ch);
foreach ($result['data']['items'] as $item) {
    echo $item['sku'] . ': ' . $item['currentStock'] . "\n";
}

Verifying a webhook signature

This runs on your own server, in the handler that receives Tijar Suite’s webhook POSTs — there’s no outbound API call here, just a signature check against the raw request body.

Node.js (Express)const crypto = require('crypto');

app.post('/webhooks/tijar-suite', express.raw({ type: 'application/json' }), (req, res) => {
  const timestamp = req.headers['x-webhook-timestamp'];
  const signature = req.headers['x-webhook-signature'];
  const rawBody = req.body.toString('utf8'); // raw bytes, not re-serialized JSON

  const expected = crypto
    .createHmac('sha256', process.env.TIJAR_WEBHOOK_SECRET)
    .update(`${timestamp}.${rawBody}`)
    .digest('hex');

  const valid = signature &&
    crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));

  if (!valid) return res.status(401).send('Invalid signature');

  const event = JSON.parse(rawBody);
  console.log('Received event:', event.id, event.type);
  // ...handle event.type / event.data, then:
  res.status(200).send('ok');
});

PHP$timestamp = $_SERVER['HTTP_X_WEBHOOK_TIMESTAMP'] ?? '';
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'] ?? '';
$rawBody = file_get_contents('php://input'); // raw bytes, not re-encoded JSON

$expected = hash_hmac('sha256', $timestamp . '.' . $rawBody, getenv('TIJAR_WEBHOOK_SECRET'));

if (!$signature || !hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid signature');
}

$event = json_decode($rawBody, true);
// ...handle $event['type'] / $event['data'], then:
http_response_code(200);
echo 'ok';