Metrilo Products API

openapi: 3.1.0
info:
  title: Metrilo Tracking & CRM Categories Products API
  version: v2
  description: Metrilo's server-side ingestion API for ecommerce analytics, CRM, and email marketing. Push customers, categories, products, and orders (single or batch) into a Metrilo project. All requests are POST with a JSON envelope of `{ time, token, params }`. Every backend endpoint except `/customer` requires an `X-Digest` header containing an HMAC-SHA256 of the raw request body keyed with the project's API Secret.
  contact:
    name: Metrilo
    url: https://github.com/Metrilo/custom-integration
  x-brevo: Metrilo is part of Brevo (acquired 2021).
servers:
- url: https://trk.mtrl.me/v2
  description: Metrilo tracking ingestion (production)
tags:
- name: Products
paths:
  /product:
    post:
      tags:
      - Products
      operationId: createProduct
      summary: Create or update a single product
      security:
      - xDigest: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProductEnvelope'
      responses:
        '200':
          $ref: '#/components/responses/Ok'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
  /product/batch:
    post:
      tags:
      - Products
      operationId: batchProducts
      summary: Bulk import products
      security:
      - xDigest: []
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ProductBatchEnvelope'
      responses:
        '200':
          $ref: '#/components/responses/Ok'
        '400':
          $ref: '#/components/responses/BadRequest'
        '401':
          $ref: '#/components/responses/Unauthorized'
        '403':
          $ref: '#/components/responses/Forbidden'
components:
  schemas:
    Product:
      type: object
      required:
      - id
      properties:
        id:
          type: string
        name:
          type: string
        price:
          type: number
        url:
          type: string
          format: uri
        categories:
          type: array
          items:
            type: string
          description: Array of category IDs.
    Envelope:
      type: object
      required:
      - token
      - params
      properties:
        time:
          type: integer
          format: int64
          description: Client event time in epoch milliseconds.
        token:
          type: string
          description: Project API Token (Settings -> Installation).
        params:
          type: object
    ProductBatchEnvelope:
      allOf:
      - $ref: '#/components/schemas/Envelope'
      - type: object
        properties:
          params:
            type: array
            items:
              $ref: '#/components/schemas/Product'
    ProductEnvelope:
      allOf:
      - $ref: '#/components/schemas/Envelope'
      - type: object
        properties:
          params:
            $ref: '#/components/schemas/Product'
  responses:
    Unauthorized:
      description: Invalid API token, or the X-Digest header is missing.
    BadRequest:
      description: Bad request (malformed payload).
    Forbidden:
      description: IP is on the ignore list, or the X-Digest signature is invalid.
    Ok:
      description: Request accepted for processing.
  securitySchemes:
    xDigest:
      type: apiKey
      in: header
      name: X-Digest
      description: HMAC-SHA256 digest of the raw JSON request body, keyed with the project's API Secret. Required for every backend endpoint except POST /customer.
x-provenance:
  generated: '2026-07-20'
  method: generated
  source: https://github.com/Metrilo/custom-integration
  note: Faithfully generated from Metrilo's public custom-integration API documentation (endpoints, request envelope, object fields, X-Digest auth, and HTTP status codes are all documented there). Metrilo publishes no OpenAPI of its own; this is an API Evangelist rendering of the documented backend tracking API. Field types reflect documented behavior only.