Metrilo Orders API

openapi: 3.1.0
info:
  title: Metrilo Tracking & CRM Categories Orders API
  version: v2
  description: Metrilo's server-side ingestion API for ecommerce analytics, CRM, and email marketing. Push customers, categories, products, and orders (single or batch) into a Metrilo project. All requests are POST with a JSON envelope of `{ time, token, params }`. Every backend endpoint except `/customer` requires an `X-Digest` header containing an HMAC-SHA256 of the raw request body keyed with the project's API Secret.
  contact:
    name: Metrilo
    url: https://github.com/Metrilo/custom-integration
  x-brevo: Metrilo is part of Brevo (acquired 2021).
servers:
- url: https://trk.mtrl.me/v2
  description: Metrilo tracking ingestion (production)
tags:
- name: Orders
paths:
  /order:
    post:
      tags:
      - Orders
      operationId: createOrder
      summary: Create or update a single order
      security:
      - xDigest: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrderEnvelope'
      responses:
        '200':
          $ref: '#/components/responses/Ok'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /order/batch:
    post:
      tags:
      - Orders
      operationId: batchOrders
      summary: Bulk import orders
      security:
      - xDigest: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/OrderBatchEnvelope'
      responses:
        '200':
          $ref: '#/components/responses/Ok'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  schemas:
    Envelope:
      type: object
      required:
      - token
      - params
      properties:
        time:
          type: integer
          format: int64
          description: Client event time in epoch milliseconds.
        token:
          type: string
          description: Project API Token (Settings -> Installation).
        params:
          type: object
    OrderEnvelope:
      allOf:
      - $ref: '#/components/schemas/Envelope'
      - type: object
        properties:
          params:
            $ref: '#/components/schemas/Order'
    OrderBatchEnvelope:
      allOf:
      - $ref: '#/components/schemas/Envelope'
      - type: object
        properties:
          params:
            type: array
            items:
              $ref: '#/components/schemas/Order'
    Order:
      type: object
      required:
      - id
      properties:
        id:
          type: string
        createdAt:
          type: integer
          format: int64
          description: Epoch ms
        email:
          type: string
          format: email
        amount:
          type: number
        status:
          type: string
          description: e.g. completed
        products:
          type: array
          items:
            $ref: '#/components/schemas/OrderLine'
    OrderLine:
      type: object
      properties:
        productId:
          type: string
        quantity:
          type: integer
  responses:
    Unauthorized:
      description: Invalid API token, or the X-Digest header is missing.
    BadRequest:
      description: Bad request (malformed payload).
    Forbidden:
      description: IP is on the ignore list, or the X-Digest signature is invalid.
    Ok:
      description: Request accepted for processing.
  securitySchemes:
    xDigest:
      type: apiKey
      in: header
      name: X-Digest
      description: HMAC-SHA256 digest of the raw JSON request body, keyed with the project's API Secret. Required for every backend endpoint except POST /customer.
x-provenance:
  generated: '2026-07-20'
  method: generated
  source: https://github.com/Metrilo/custom-integration
  note: Faithfully generated from Metrilo's public custom-integration API documentation (endpoints, request envelope, object fields, X-Digest auth, and HTTP status codes are all documented there). Metrilo publishes no OpenAPI of its own; this is an API Evangelist rendering of the documented backend tracking API. Field types reflect documented behavior only.