API reference
Generated from the OpenAPI description the backend publishes — the same decorators that produce this file also drive the server's validation and its scope guard.
Base URL
Every path below is shown exactly as the server routes it. Prefix it with the API host:
https://api.salafems.com/ext/v1Authentication
Two headers, no handshake. The API version documented here is 2026-08.
Authorization: Bearer salaf_sk_YOUR_API_KEY
Accept: application/jsonEach operation lists the scope its key must hold. A key with orders:write also satisfies orders:read; the reverse is never true. See Authentication.
Every response body below — and every field, type and default in the parameter tables — is generated from the description itself, so this reference cannot describe an endpoint the server does not serve. The only hand-written JSON is the example request bodies, because a schema cannot say which optional fields form a valid combination.
Resources
27 endpoints across 8 resources — 17 reads and 10 writes. Writes take an Idempotency-Key; three of them require it — see Writes & idempotency.
Trying requests
Each resource page has a key field at the top. Paste your key and every snippet on that page — all four languages at once — switches from the placeholder to your key, ready to copy and run in your terminal.
Every endpoint also carries a Try it panel that sends a real request. It runs from your browser, straight to the API host you pick (production or localhost:5000): the key is read from your browser’s localStorage, attached to that one request, and never sent anywhere else — these pages are static files with no server of their own behind them.