Limitra Supplier Service

Go microservice that bridges the Limitra marketplace with upstream retailers. It fetches product data from Amazon and eBay, checks availability, places orders via headless browser automation, and signs Quick Buy payloads for the admin Chrome extension.

Every endpoint returns JSON. All non-public endpoints require an internal service secret header. Orders run a two-phase flow — placement, then explicit confirmation — so an operator can review before the purchase commits.

Base URL

http://supplier-service:8082

Endpoints

Authentication

Every request except /health must carry an X-Internal-Service-Secret header. The secret is shared between the supplier service and the other Limitra services that call it. Requests missing or with an incorrect secret receive 401 Unauthorized.

Example headers

POST /availability HTTP/1.1
Host: supplier-service:8082
Content-Type: application/json
X-Internal-Service-Secret: <your-secret>

/health skips authentication so upstream probes can check liveness without credentials.

Secret for Try It

Paste the service secret here to use the interactive Try It panels below. It is kept only in this browser (localStorage) and sent as X-Internal-Service-Secret.

Health & Status

Live check against GET /health. Probes the running instance serving this page.

Not checked yet

Auto-refresh paused

Dependencies

Live status from GET /health/detailed. Refreshes every 30 seconds alongside the health check above.

Product Import

Fetch a single product by supplier identifier and persist it to the catalog.

{
  "id": 1024,
  "supplier_id": "B0CXYZ1234",
  "supplier": "amazon",
  "title": "Sony WH-1000XM5 Headphones",
  "price": "349.99",
  "currency": "USD",
  "available": true,
  "fetched_at": "2026-04-18T09:00:00Z"
}

—

{
  "supplier_id": "v1|123456789|0",
  "supplier": "ebay",
  "title": "Apple AirPods Pro 2",
  "price": "189.00",
  "currency": "USD",
  "available": true
}

—

Product Search

Keyword search against one supplier or all suppliers in parallel.

{
  "products": [ ... ],
  "total": 42,
  "page": 1,
  "supplier": "all",
  "warnings": ["ebay: timeout"]
}

—

{
  "products": [ ... ],
  "total": 120,
  "page": 1
}

—

—

Availability

{
  "supplier": "amazon",
  "supplier_id": "B0CXYZ1234"
}

{
  "supplier": "amazon",
  "supplier_id": "B0CXYZ1234",
  "available": true,
  "price": "349.99",
  "checked_at": "2026-04-18T09:00:00Z"
}

—

Order Placement

Orders run in two phases. POST /order creates a pending session. POST /order/:sessionId/confirm finalizes it.

{
  "supplier": "amazon",
  "supplier_id": "B0CXYZ1234",
  "variant_id": "black-large",
  "quantity": 1,
  "address": {
    "full_name": "Jane Doe",
    "line1": "1600 Amphitheatre Pkwy",
    "city": "Mountain View",
    "state": "CA",
    "zip_code": "94043"
  }
}

{
  "session_id": "sess_2f9a...",
  "supplier": "amazon",
  "status": "pending_confirmation",
  "created_at": "2026-04-18T09:00:00Z"
}

—

{
  "session_id": "sess_2f9a...",
  "supplier_order_ref": "114-7234056-0123456",
  "status": "confirmed",
  "confirmed_at": "2026-04-18T09:02:14Z"
}

—

Quick Buy

HMAC-SHA256 signing for payloads consumed by the admin Chrome extension. Payloads expire 15 minutes after signing.

{
  "order_payload": { ... },
  "signature": "b6f3...",
  "expires_at": "2026-04-18T09:15:00Z"
}

—

{ "valid": true }

—

Error Reference

Every error response is a JSON object of the form { "error": "message" }.