Metrilo Categories API

openapi: 3.1.0
info:
  title: Metrilo Tracking & CRM Categories API
  version: v2
  description: Metrilo's server-side ingestion API for ecommerce analytics, CRM, and email marketing. Push customers, categories, products, and orders (single or batch) into a Metrilo project. All requests are POST with a JSON envelope of `{ time, token, params }`. Every backend endpoint except `/customer` requires an `X-Digest` header containing an HMAC-SHA256 of the raw request body keyed with the project's API Secret.
  contact:
    name: Metrilo
    url: https://github.com/Metrilo/custom-integration
  x-brevo: Metrilo is part of Brevo (acquired 2021).
servers:
- url: https://trk.mtrl.me/v2
  description: Metrilo tracking ingestion (production)
tags:
- name: Categories
paths:
  /category:
    post:
      tags:
      - Categories
      operationId: createCategory
      summary: Create or update a single category
      security:
      - xDigest: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CategoryEnvelope'
      responses:
        '200':
          $ref: '#/components/responses/Ok'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /category/batch:
    post:
      tags:
      - Categories
      operationId: batchCategories
      summary: Bulk import categories
      security:
      - xDigest: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CategoryBatchEnvelope'
      responses:
        '200':
          $ref: '#/components/responses/Ok'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  schemas:
    CategoryBatchEnvelope:
      allOf:
      - $ref: '#/components/schemas/Envelope'
      - type: object
        properties:
          params:
            type: array
            items:
              $ref: '#/components/schemas/Category'
    Category:
      type: object
      required:
      - id
      properties:
        id:
          type: string
        name:
          type: string
        url:
          type: string
          format: uri
    CategoryEnvelope:
      allOf:
      - $ref: '#/components/schemas/Envelope'
      - type: object
        properties:
          params:
            $ref: '#/components/schemas/Category'
    Envelope:
      type: object
      required:
      - token
      - params
      properties:
        time:
          type: integer
          format: int64
          description: Client event time in epoch milliseconds.
        token:
          type: string
          description: Project API Token (Settings -> Installation).
        params:
          type: object
  responses:
    Unauthorized:
      description: Invalid API token, or the X-Digest header is missing.
    BadRequest:
      description: Bad request (malformed payload).
    Forbidden:
      description: IP is on the ignore list, or the X-Digest signature is invalid.
    Ok:
      description: Request accepted for processing.
  securitySchemes:
    xDigest:
      type: apiKey
      in: header
      name: X-Digest
      description: HMAC-SHA256 digest of the raw JSON request body, keyed with the project's API Secret. Required for every backend endpoint except POST /customer.
x-provenance:
  generated: '2026-07-20'
  method: generated
  source: https://github.com/Metrilo/custom-integration
  note: Faithfully generated from Metrilo's public custom-integration API documentation (endpoints, request envelope, object fields, X-Digest auth, and HTTP status codes are all documented there). Metrilo publishes no OpenAPI of its own; this is an API Evangelist rendering of the documented backend tracking API. Field types reflect documented behavior only.