Use this private API for merchant and operator workflows. Choose it when trusted server-side code needs to change catalog data, commerce records, publishing state, media assets, access settings, or operational records.

Use operation pages and the OpenAPI spec for exact methods, paths, parameters, request bodies, and response schemas.

• API track: Management API.
• API version: latest.
• Spec: OpenAPI.
• Reference route: /reference/openapi/management-api.
• Playground: /apis/management/playground.

Use this API for

• ERP, PIM, DAM, or warehouse integrations that sync merchant-owned data.
• Custom admin tools for catalog, order, channel, market, or merchandising work.
• Bulk product edits, draft workflows, scheduling, static listings, and smart listings.
• Back-office jobs that run with a trusted bearer token.
• Organization, user, role, warehouse, tax, redirect, and log changes.

Do not use the Management API for browser-only public storefront reads. Use the Shopper API for public catalog display and Auth API for customer identity or account-scoped shopper state.

Before you build

Collect these values from your Enad environment:

• Management token: send it as Authorization: Bearer \{management_token\} from server-side code only. Do not expose it in browser code.
• Team slug: use it in the base path to identify the team or tenant for administrative routes.
• App slug: use it in the base path to identify the app being managed inside the team.
• Target operation: open the operation page before deciding request shape.

Auth and placement

Server-side integrations authenticate with a bearer token in the Authorization header.

Authorization: Bearer {management_token}

Run calls from trusted server-side code, jobs, or controlled internal tools. If a frontend needs admin data, put your own backend between the browser and Enad so the token stays private and your app can enforce operator access.

Each request is resolved against the Authorization header, the team_slug, and the app_slug before the operation handler runs. Bearer credentials must belong to the target app and use the Management token resource. After the token is accepted, the token role permissions are attached to the request context, and each route still checks the permission required for that operation. If a request fails before business logic runs, verify the team slug, app slug, token app, token resource, and role permissions before retrying.

Base path shape

Operations are scoped by team and app.

https://api.enad.io/api/v1/{team_slug}/{app_slug}

When an operation path shows colon-prefixed variables such as :team_slug or :app_slug, treat them as path variables and replace them with the real team and app values before making requests.

DAM administration route split

DAM administration is part of the Management API when the job changes folder, placement, role, or share-link state. Use Management routes under /api/v1/\{team_slug\}/\{app_slug\}/dam/... when an internal tool or server-side integration needs to:

• Create, update, read, or delete DAM folders.
• Assign images, videos, or files to DAM folders.
• Manage folder role access.
• Search DAM media as an authenticated operator.
• Create, update, delete, or change resources on shareable links.

Do not use these Management routes for public asset-library browsing. Public asset-library reads use dam.enad.io routes scoped by app_id for folder trees, folder contents, folder facets, media search, and token-backed shareable-link reads. Start with Asset library reads and DAM administration when you need to choose between public library reads and trusted DAM administration.

Choose the right area

Use the Management API only after the job needs trusted administration or server-side automation.

• Catalog records: Products, Product Drafts, Variants, Variant Groups, Variant Templates, prices, and stock.
• Catalog organization: Categories, Collections, Brands, Series, Tags, Attributes, and Relations.
• Publishing and merchandising: Channels, channel content, Smart Listings, Static Listings, Product Bundles, Bundle Rules, and Scheduling.
• Internal account operations: Orders, Customer Groups, Organizations, Merchant Users, and Custom Roles.
• Market and fulfillment setup: Store Groups, Markets, Warehouses, and Tax Groups.
• Asset administration: DAM, Images, Files, Videos, Media, and Shareable Links.
• Routing and handoff records: Redirects, Third Party Link, Translations, and Logs.

Some domains appear in more than one place because the caller is different. Use Management for trusted administration, Auth for customer identity and account-scoped state, Search GraphQL for new storefront discovery, and Shopper REST only for existing public catalog reads that already depend on that route shape.

Bulk and write behavior

Management write operations can affect more than the record in the request body. Product, attribute, channel, redirect, relation, listing, stock, price, draft, and media workflows may publish events, update relationship order, recompute publishing state, or trigger downstream sync work.

Bulk endpoints are not all the same. Some Management operations report separate successful and failed item collections or allow partial success. Other operations are documented as atomic or use operation-specific transaction behavior. Treat the response body as the reconciliation source, read item-level failures before marking a sync complete, and use the operation page for exact limits and rollback behavior.

Safe usage guidance

Pick the entity or workflow, open the Management OpenAPI reference, confirm the method/path/body/response, and test with non-production data before moving the call into server-side code.

Keep Management tokens out of browsers, mobile binaries, public repositories, and client-side logs. Validate that an internal user is allowed to perform the requested operation before proxying Management API calls.

For Users, Orders, Organisations, Cart, Wishlist, and Customer Groups, choose by caller before choosing credentials. Customer or account-scoped state belongs in Auth API. Trusted administration stays in Management.

Playground and reference

• Management API playground loads /swagger/management-api.json and lets you test current operations interactively.
• Management OpenAPI reference exposes the complete Management contract.
• OpenAPI specs index lists the available API contracts.

Version behavior

latest moves with the current recommended Management API contract. Existing integrations should pin to a specific version route once archived versions are published.