API Overview

Base URL, authentication, error handling, pagination, rate limits, and conventions for the Anderro API.

Base URL

All API requests should be made to:

https://anderro.com/api/v1

Authentication

Every request must include your secret key in the x-api-key header:

bash
curl -H "x-api-key: sk_your_secret_key" https://anderro.com/api/v1/affiliates

See Authentication for details on finding and managing your API key.

Request format

  • All request bodies must be JSON with Content-Type: application/json
  • All responses are JSON

Currency

Commissions are computed in USD; non-USD sales are not auto-commissioned yet. Tracking /events payments accept an optional currency field, for example "currency": "USD". Omitted or null currency means amountCents is in USD cents; an explicit non-USD currency is rejected with HTTP 400. Signups ignore currency. Paddle payments with a non-USD or missing currency are skipped; their signups can still be recorded. SamCart payloads carry no currency, so their amounts are treated as USD.

Response envelope

Most endpoints use the following response envelopes:

Single resource:

json
{
  "data": { ... }
}

List (paginated):

json
{
  "data": [ ... ],
  "pagination": {
    "next_cursor": "...",
    "has_more": true
  }
}

Error:

json
{
  "error": "Error message",
  "details": { ... }
}

Field naming

New endpoints (list, get, update, stats, commissions, payouts) use snake_case field names in responses, consistent with webhook payloads. The original registration and removal endpoints continue to use camelCase for backwards compatibility.

Pagination

List endpoints use cursor-based pagination. See the Pagination guide for details.

ParameterDefaultMax
limit50100
cursor--

Rate limits

All API endpoints are rate-limited to 60 requests per minute per API key. See Rate Limits for details on headers and retry handling.

Request ID

Every response includes an X-Request-Id header with a unique identifier. Include this when contacting support for faster debugging.

Error format

Most errors return a JSON object with a top-level error field:

json
{
  "error": "Validation failed",
  "details": {
    "fieldErrors": {
      "email": ["Invalid email address"]
    },
    "formErrors": []
  }
}

For an invalid period, /api/v1/stats and /api/v1/stats/timeseries return HTTP 400 with this different envelope:

json
{"data":{"error":"Invalid period. Must be 7d, 30d, 90d, or 12m."}}

HTTP status codes

StatusMeaning
200Success (update/action)
201Success (resource created)
400Validation error - check request body
401Authentication failed - check API key
404Resource not found
409Conflict - resource already exists or already in target state
422Semantically invalid input (e.g. refund amount exceeds payment)
429Rate limit exceeded - retry after delay
500Internal server error

Available endpoints

Affiliates

MethodEndpointDescription
GET/api/v1/affiliatesList affiliates
GET/api/v1/affiliates/:idGet affiliate details
POST/api/v1/affiliatesRegister a single affiliate
POST/api/v1/affiliates/bulkRegister up to 100 affiliates
PATCH/api/v1/affiliates/:idUpdate affiliate status
POST/api/v1/affiliates/removeRemove a single affiliate
POST/api/v1/affiliates/remove/bulkRemove up to 100 affiliates

Stats

MethodEndpointDescription
GET/api/v1/statsGet summary KPIs
GET/api/v1/stats/timeseriesGet daily time series

Commissions

MethodEndpointDescription
GET/api/v1/commissionsList commissions
GET/api/v1/commissions/:idGet commission details

Payouts

MethodEndpointDescription
GET/api/v1/payoutsList payouts
GET/api/v1/payouts/:idGet payout details
PATCH/api/v1/payouts/:idUpdate payout (approve/reject/mark paid)

Refunds

MethodEndpointDescription
POST/api/v1/refundsRefund a commission

Customers

MethodEndpointDescription
DELETE/api/v1/customersErase end-customer data (GDPR)