HTTP endpoints

For developers

All Admin API routes need an Admin API token (Authorization: Bearer …) and the privilege listed. Errors use Shopware's shape: {"errors": [{"detail": "…"}]}.

Targets, mappings, mapping versions, credentials, exports and attempts are also ordinary DAL entities, readable and writable through the generic Admin API (/api/kmh-order-export-config, /api/search/kmh-order-export, …) with the matching entity privileges — except credential secrets, which are stripped from every read.

Exports

POST /api/_action/kmh-order-export/export

Exports one order to one target, synchronously. Privilege kmh_order_export:update.

Field	Required	Description
orderId	yes	Order ID
configId	yes	Export target ID
forceReExport	no	true to send a new revision even if nothing changed

{
  "outcome": "exported",
  "orderExportId": "0190f5b2…",
  "revision": 1,
  "correlationId": "0190f5b3…",
  "attemptId": "0190f5b4…"
}

outcome: exported, acknowledged, awaiting_acknowledgement, deduplicated, failed.

Status	When
400	orderId or configId missing
404	Target (active) or order not found
409	Another export of this order to this target is running
422	The mapping could not render the order; errors[0].meta.fieldErrors lists the fields
502	Transport error reaching the target

POST /api/_action/kmh-order-export/test-connection

Privilege kmh_order_export_config:read. Body {"configId": "…"}. Sends GET to the target URL with its authentication.

{ "reachable": true, "httpStatus": 405, "message": "…" }

Mappings

Privilege kmh_order_export_mapping:read for all four.

POST /api/_action/kmh-order-export/mapping/validate

Body {"definition": { … }} → {"valid": false, "problems": ["total: \"expr\" must be a string"]}.

POST /api/_action/kmh-order-export/mapping/preview

Renders a definition against a real order. Nothing is sent.

Body {"definition": { … }, "orderId": "…"} →

{ "valid": true, "problems": [], "data": { "orderNumber": "10001" }, "errors": {} }

problems are validation problems (nothing rendered); errors are per-field render errors. 404 if the order does not exist.

POST /api/_action/kmh-order-export/mapping/export

Body {"definition": { … }, "format": "json" | "yaml"} → {"content": "…", "format": "json"}.

POST /api/_action/kmh-order-export/mapping/import

Body {"content": "…", "format": "json" | "yaml"} → {"valid": true, "definition": { … }} or {"valid": false, "error": "…"}. Parses only; save the definition yourself.

Credentials

Secrets are write-only through these endpoints.

Method & path	Privilege	Purpose
GET /api/_action/kmh-order-export/credential	kmh_order_export_credential:read	List: {"data": [{"id", "name", "authType", "publicMeta", "rotatedAt", "secretSet"}]}
GET /api/_action/kmh-order-export/credential/{id}	kmh_order_export_credential:read	One credential, same shape; 404 if unknown
POST /api/_action/kmh-order-export/credential/save	kmh_order_export_credential:update	Create or update: id (optional), name, authType (none, api_key, basic, bearer, oauth2), publicMeta (headerName / username / tokenUrl, clientId, scope), secret (omit to keep the current one). Returns {"id", "secretSet"}.

Callback

POST /kmh-order-export/acknowledge

Storefront route, no Shopware authentication, HMAC-verified. See Acknowledgement callback.