Integrations

Drelife sits between your shop platform, your shoppers and your partners. This page gathers what an integrator needs beyond the endpoints of the previous pages: how a server authenticates, how partners get access to your shoppers' flows, how Drelife notifies your systems, and what the connection with your platform does.

Authenticate a server

Create a dedicated user for each integration (POST /users, see Set up your shop) with the smallest role that covers what it does: an Approver for a system that processes requests, a PreApprover for a warehouse that verifies parcels, a Publisher for a tool that publishes second-life items, a Manager for one that configures the shop. Then give the integration a merchant API key bound to that user, so it never holds a password:

Both logins answer 201 with accessToken (tokenType Bearer), the roles and the modes of the user, and expiresIn, the date the token expires (one hour by default). There is no refresh call: log in again when it expires, and keep in mind each login is limited to ten calls per minute per IP. A session opened with a key ends within a minute once the key is revoked, or its user is disabled, deleted or loses a role or mode the session carries (401 ApiKeyRevoked: log in with the key again), and cannot manage users nor API keys (403 NotAvailableWithApiKey). POST /login with the email and the password (or the access token) of the user still works, but its credentials also open the dashboard and cannot be revoked without changing the password.

Tokens are RS256 JSON Web Tokens; the public keys are published at GET /.well-known/jwks.json if your systems want to verify one. The API only emits CORS headers for the Drelife dashboard, so it is meant to be called from a server, not from a browser page of your own.

Every response over the quota (one hundred and twenty requests per minute per IP by default) is 429 TooManyRequests; spread the calls or cache what does not change.

Partner access to the customer API

A partner acting for your shoppers (a chat that creates returns, a helpdesk that follows them) uses the customer API, not this one. It identifies itself with a customer API key of your shop, which you manage here as StoreOwner or Manager:

A customer key grants nothing on the merchant API, and a merchant key is refused by the customer API: each key opens one API. A customer key lets the partner log in as your shoppers from its servers, gives it its own rate limit, and appears in the returns it creates. Hand it over through a secure channel, one key per partner, and revoke it when the partner leaves.

Webhooks

Drelife can call a URL of your choice (or of your partner) when a request of the shop is created, updated or deleted. Subscriptions are configured by Drelife on request: send the HTTPS URL, the events you want, the headers your endpoint needs, and you get back the secret that signs every notification.

Each notification is a POST with a JSON body:

{
  "event": "returns.created",
  "reference": "1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d",
  "createdAt": "2026-09-16T10:12:00.000Z",
  "customer": { "firstName": "Jane", "lastName": "Doe", "email": "[email protected]" },
  "store": { "id": "...", "name": "Your Shop" },
  "shipping": { "carrier": "GLS", "trackingNumber": "12345678", "labelUrl": "https://...", "packages": 1 },
  "items": [
    {
      "id": "d38fce81-...",
      "sku": "TS-M-BLK",
      "ean": "TS-M-BLK",
      "name": "Essentials slim T-shirt",
      "productId": "8253231888",
      "productName": "Essentials slim T-shirt",
      "variantId": "47046763118885",
      "variantName": "M / Black",
      "quantityExpected": 1,
      "reasonDetail": "Too small",
      "customerComment": "It is too small",
      "attachments": [ { "url": "https://...", "type": "image/jpeg", "createdAt": "2026-09-16T10:10:00.000Z" } ]
    }
  ]
}

reference is the Drelife identifier of the request, the one GET /returns/{id}, /purchases/{id} and /repairs/{id} take. customer comes from the address of the request, shipping.carrier is Unknown and trackingNumber and labelUrl are null while there is no shipment. One entry per unit (quantityExpected is always 1); ean falls back to the sku. A request whose units have no SKU, or whose units are not order lines (second-life offers of a catalog category, self-listings), is not delivered.

Headers:

Verify the signature on the exact bytes received before parsing. The endpoint must answer within ten seconds with a 2xx; redirects are not followed. A failed delivery (no 2xx, or a timeout) may be re-sent by the Drelife task queue; every attempt carries a new X-Event-Id and goes to every subscription of the shop again, so make the handler idempotent on event and reference (and on the state you read from the API) rather than on X-Event-Id, and fetch the current state from the API when a notification never arrives. The URL must be HTTPS on a public host.

Your shop platform

Drelife connects to Shopify, PrestaShop and Logicommerce, and works without a platform for a Custom shop. The connection is set up by Drelife; from the merchant API it shows in what happens automatically:

• Orders are imported from the platform, and GET /orders/{id} accepts the platform identifier. A Custom shop pushes its orders with POST /orders (see Orders).
• Returns and exchanges are created in the platform when the return is accepted or processed, the refund is issued through the platform (original payment, store credit or gift card), restocks apply to Shopify and PrestaShop, and the exchange order is created there. A Custom shop records the decisions and refunds on its own side.
• Second-life items are published as products in Shopify (see Second life and repairs).
• Identifiers: the detail of a return gives order.id and exchange.id in your platform; GET /returns/{shopID} finds a return by its platform identifier.

The error 400 This return has not been processed in the CMS on a processing means the return does not exist yet in the platform; it is created asynchronously after the acceptance, so wait and retry.

Environments and secrets

The demo environment (https://merchant.services.demo.drelife.com) is a separate installation with its own shops, users, API keys and webhook subscriptions; nothing created there reaches production. Test an integration on demo with the demo shop Drelife provides, then repeat the configuration (users, keys, subscriptions) on production.