API docs

Changelog

2026-10-08: reorder amount

Products gain reorder_qty (read and write; null = not set): how many Iron Register's Reorder orders when a location has no reorder quantity of its own. Nothing existing changed.
Setting a product's vendor_id / vendor_sku now also makes that vendor the preferred one on the product's vendor list in Iron Register.

Coupons gain location_id (null = every location, as before). A coupon with a location is refused at other locations' registers; with channel: store_online it is published to that location's own BigCommerce storefront only (Multi-Storefront), and saving it is refused with VALIDATION_ERROR when the location has no storefront.

GET /v1/events: without customers:read, a customer embedded in an event payload is reduced to {"object": "customer", "id": …}, matching GET /v1/orders. Keys with customers:read see no change.
POST /v1/customers/{id}/account/payments: paying more than is owed now needs the store_credit write permission too. Without it the call is refused with 422 OVERPAYMENT instead of banking the extra as store credit.
Memberships: a location-limited key can cancel only memberships homed at its locations (404 otherwise), and a sign-up without location_id is homed at the key's location.

New accounts permission (read / write): GET /v1/customers/{id}/account, GET /v1/invoices, GET /v1/invoices/{id}, GET /v1/account-payments, and POST /v1/customers/{id}/account/payments to record money received elsewhere (an Idempotency-Key is required). See House accounts and invoices.
New memberships permission (read / write): GET /v1/membership-plans, GET /v1/memberships, GET /v1/memberships/{id}, POST /v1/memberships, POST /v1/memberships/{id}/cancel and /guest-pass. See Memberships.
New card_transactions permission (read): GET /v1/card-transactions, GET /v1/card-transactions/{id}. See Card transactions.
New webhook events: invoice.created, invoice.updated, account.payment_received, membership.created, membership.updated, membership.payment_failed.
New errors: ALREADY_MEMBER, PLAN_ARCHIVED, MEMBERSHIPS_OFF, CARD_PROCESSING_OFF, NO_GUEST_PASSES, MEMBERSHIP_FULL.

Order payments[] gain entry (terminal, token, manual), processor (payroc), approval_code and refund_of_payment_id for shops that run card processing. All four are null otherwise; nothing existing changed.
New line type membership on orders (a membership sign-up, initiation fee or dues).
payments[].tender can be on_account (house accounts).

GET /v1/range/rentals, GET /v1/range/rentals/{id} and GET /v1/range/rental-checkouts (permission range:read): the fleet, where each gun is, and the custody history with condition and rounds fired.
New webhook events: range.rental.checked_out, range.rental.checked_in, range.rental.out_of_service, range.rental.returned_to_service.

New store_credit permission (read / write): GET /v1/customers/{id}/store-credit, GET /v1/store-credit, POST /v1/customers/{id}/store-credit/issue and /redeem.
Gift certificates: POST /v1/gift-certificates/{id}/reload and /adjust.
Every balance move (store credit issue and redeem; gift certificate redeem, reverse, reload and adjust) requires an Idempotency-Key.
New webhook event: store_credit.changed.
New error: INSUFFICIENT_CREDIT.

gift_certificates, coupons and locations are now read / write; range write goes beyond cancelling.
Gift certificates: POST /v1/gift-certificates (issue), POST /v1/gift-certificates/{id}/redeem and /reverse (an Idempotency-Key is required), /disable, /enable. GET /v1/gift-certificates/{id} now includes the last 50 ledger transactions.
Coupons: POST /v1/coupons, PATCH /v1/coupons/{id}, DELETE /v1/coupons/{id}.
Locations: PATCH /v1/locations/{id} for phone, email and business hours.
Range: GET /v1/range/availability, POST /v1/range/reservations (lanes and class seats, paid on your channel or unpaid), /check-in, /no-show.
New webhook events: gift_certificate.issued, gift_certificate.updated.
New errors: IDEMPOTENCY_KEY_REQUIRED, FIELD_NOT_WRITABLE, CODE_TAKEN, GIFT_CERTIFICATE_INACTIVE, GIFT_CERTIFICATE_INSUFFICIENT, GIFT_CERTIFICATE_CODE_TAKEN, GIFT_CERTIFICATE_CODE_INVALID, RESOURCE_UNAVAILABLE, SESSION_FULL, INVALID_RESOURCE, INVALID_SESSION, CONSTRAINT_VIOLATION.

purchase_orders is now read / write.
New endpoints: POST /v1/purchase-orders, PATCH /v1/purchase-orders/{id}, and POST /v1/purchase-orders/{id}/submit, /cancel and /receive. Receiving through the API covers non-serialized lines and adds stock.
New webhook event: purchase_order.cancelled.
New errors: PO_SUBMITTED, DUPLICATE_PURCHASE_ORDER, NOTHING_OUTSTANDING, EMPTY_PO.
Validation errors are 400 VALIDATION_ERROR everywhere.

The first release of the Iron Register API.

API keys. Owner-issued, with per-resource none/read/write permissions, location limits, IP allowlists, expiry, and rolling with a grace period.
Resources.
- Products (with categories and vendors), inventory levels, serialized units and movements.
- Customers, with date of birth behind its own permission.
- Orders, including creating orders from outside channels and voiding non-firearm orders.
- Returns, purchase orders, gift certificates, coupons and locations.
- Range resources, classes, sessions and reservations.
- /v1/me and the /v1/events feed.
Webhooks. 25 event types (28 today, with purchase-order and gift certificate events), HMAC-SHA256 signatures with secret rotation, a custom auth header, retries over about 37 hours, auto-disable, and resend from the delivery log.
Limits. Established: 60 requests per minute and 10,000 per day. Enterprise: 600 per minute.
Sandbox. sandbox.ironregister.com, with a shop per partner and daily simulated activity.