Core APIs (latest)
Metadata
| Key | Value |
|---|---|
| redocly_category | API Reference |
The Rebilly API is built on HTTP and is RESTful. It has predictable resource URLs and returns HTTP response codes to indicate errors. It also accepts and returns JSON in the HTTP body. Use your favorite HTTP/REST library in your programming language when using this API, or use one of the Rebilly SDKs, which are available in PHP and JavaScript.
Every action in the Rebilly UI is supported by an API which is documented and available for use, so that you may automate any necessary workflows or processes. This API reference documentation contains the most commonly integrated resources.
Each environment has its own base URL. The organization ID is part of the path.
| Environment | Base URL |
|---|---|
| Sandbox | https://api-sandbox.rebilly.com/organizations/{organizationId} |
| Live | https://api.rebilly.com/organizations/{organizationId} |
The sandbox and live environments do not share data, API keys, or configuration. For more information, see Environments.
To obtain your organization ID, see Obtain your organization ID and website ID.
Rebilly offers four forms of authentication: secret key, publishable key, JSON Web Tokens, and public signature key.
- Secret API key: Use to make requests from the server side. Send the key in the
REB-APIKEYheader. Sandbox keys start withsk_sandbox_and live keys start withsk_live_. To obtain a key, see Obtain a secret key. Never share these keys. Keep them guarded and secure. - Publishable API key: Use in your client-side code to tokenize payment information.
- JWT: Use to make short-life tokens that expire after a set period of time.
To create or manage API keys, select one of the following:
- Use the Rebilly UI: see Manage API keys
- Use the Rebilly API: see the API key operations.
For more information on API keys, see API keys.
Rebilly follows the error response format proposed in RFC 9457, which is also known as Problem Details for HTTP APIs. As with any API responses, your client must be prepared to gracefully handle additional members of the response.
Rebilly provides a JavaScript SDK and a PHP SDK to help interact with the Rebilly API. However, no SDK is required to use the API.
Rebilly also provides FramePay, a client-side iFrame-based solution, to help create payment tokens while minimizing PCI DSS compliance burdens and maximizing your customization ability. FramePay interacts with the payment tokens creation operation.
For installation and usage instructions, see SDKs. All JavaScript SDK code examples are included in the API reference documentation.
For installation and usage instructions, see SDKs. All SDK code examples are included in the API reference documentation. To use them, you must configure the $client as follows:
$client = new Rebilly\Client([
'apiKey' => 'YourApiKeyHere',
'baseUrl' => 'https://api.rebilly.com',
]);
The full Rebilly API has over 500 operations. This is likely more than you may need to implement your use cases. If you would like to implement a particular use case, contact Rebilly for guidance and feedback on the best API operations to use for the task.
To integrate Rebilly, and learn about related resources and concepts, see Get started.
To create and manage API keys, see API keys.
This cURL request lists the five most recent customers in your sandbox organization.
In a terminal, paste the following command:
curl 'https://api-sandbox.rebilly.com/organizations/your_organization_id/customers?limit=5&sort=-createdTime' \ -H 'REB-APIKEY: your_secret_API_key'Replace
your_organization_idwith your organization ID. For more information, see Obtain your organization ID and website ID.Replace
your_secret_API_keywith a sandbox secret key. For more information, see Obtain a secret key.Run the command.
In the response, a 200 status code indicates a successful request. The response body contains a JSON array of customers. An empty array means the request succeeded and the organization has no customers yet.
List operations accept limit, offset, filter, and sort query parameters. For more information on filters, see Search filters.
To try operations in the browser, use the interactive examples in Set up your environment.
Rate limits apply to the organization, not to the API key.
API responses for rate-limited operations include Rate-Limit-Limit and Rate-Limit-Remaining. Rate-Limit-Limit is the maximum number of requests available at one time. Rate-Limit-Remaining is the number of requests still available.
A request over the limit returns 429 Too Many Requests. The response includes Retry-After and Rate-Limit-Retry-After. Both values are the number of seconds to wait before retrying.