API documentation

Introduction

The SellerPort API is the same interface the dashboard itself uses. Every response is scoped to a single workspace, so a request can only ever return data for the account you are signed in as.

Base URL for a production workspace:

https://dashboard.growithamazon.com

Connecting a source

Before any endpoint returns data, the workspace needs at least one connected platform. Connection happens through the provider's own consent screen — SellerPort never asks for, stores or transmits your marketplace password.

1. 1
   Pick your platforms. At signup, or later from Connections & Settings, select the channels you sell on. Only selected platforms appear in your workspace.
2. 2
   Authorize. Press Authorize & connect on a platform card. You are redirected to the provider, you approve, and you land back on your settings page with that card marked Connected.
3. 3
   Wait for the first sync. The initial pull backfills history; afterwards data refreshes on a schedule with on-demand refresh available.

The authorization flow can also be started directly. This redirects to the provider and returns to /<workspace>/settings?connected=<platform>:

GET /api/oauth/amazon/start?platform=amazon_sp_api

# platform: amazon_sp_api | amazon_ads | vendor_central

Authentication

Requests are authenticated with the gwa_session cookie issued at login. It is HttpOnly, SameSite=Lax, and secure in production. Send it with every request.

curl 'https://dashboard.growithamazon.com/api/dashboard?client=YOUR_WORKSPACE' \
  -H 'Cookie: gwa_session=<your session cookie>'

// Same-origin from inside the dashboard — the cookie is sent automatically
const res = await fetch('/api/dashboard?client=YOUR_WORKSPACE', {
  credentials: 'include',
});
const data = await res.json();

Conventions

• Workspace scope. Most endpoints require ?client=<slug>.
• Dates. from and to are YYYY-MM-DD in Asia/Dubai (GST) — matching Amazon.ae, not IST or UTC. Use the same date in both for a single day.
• Freshness. Responses carry an X-Data-Source header — mysql, file-cache, amazon-sp-api or stale-cache — so you can tell cached data from live.
• Caching. Read endpoints send Cache-Control: private. Pass refresh=true to bypass it.

Errors

Errors return a JSON body with a single error field and a matching status code.

{ "error": "Unauthorized" }

Dashboard

The aggregate payload behind the Seller Central overview — orders, revenue and channel mix.

Vendor Central

Wholesale purchase orders, retail analytics, catalog and finance. Reads MySQL first and falls back to the Vendor SP-API bundle.

Amazon

Seller Central analytics, advertising and Buy Box intelligence.

Google & Noon

The non-Amazon channels, available once their source is connected.

Workspace & connections

Session state and the platforms a workspace has selected or connected.

Automation

Scheduled sync routes under /api/cron/* are not session-authenticated. They use a shared secret, so they can be driven by an external scheduler.

curl -X GET 'https://dashboard.growithamazon.com/api/cron/vendor-central-sync' \
  -H 'Authorization: Bearer $CRON_SECRET'