Getting Started - Dark Obsidian API Docs

Authentication

All requests require an API key sent as a Bearer token:

Authorization: Bearer do_live_YOUR_KEY

Alternatively, use the X-API-Key header:

X-API-Key: do_live_YOUR_KEY

Key format

Prefix	Environment	Use case
do_live_	Production	Real business data
do_test_	Sandbox	Development & testing

Get your API key Settings → Developer → API Keys → Create Key in your Dark Obsidian dashboard.

Base URL

https://qatxonlxvtgxvqjgfxpl.supabase.co/functions/v1/api

Request format

Send JSON bodies with Content-Type: application/json for POST/PUT requests. Parameters use camelCase keys in the URL for filtering and pagination.

Response format

All successful responses follow this envelope:

{
  "success": true,
  "data": { ... },          // resource or array
  "meta": {                 // only on paginated responses
    "page": 1,
    "per_page": 20,
    "total": 143,
    "total_pages": 8
  }
}

Error format

Errors return an appropriate HTTP status code (400, 401, 403, 404, 409, 429, or 500) with this body:

{
  "success": false,
  "error": {
    "code": "VALIDATION_ERROR",
    "message": "items array is required",
    "docs": "https://darkobsedian.sameergul.com/docs/errors#VALIDATION_ERROR"
  }
}

Pagination

All list endpoints support pagination via query parameters:

Parameter	Default	Description
page	1	Page number
per_page	20	Results per page (max 100)

Rate limits

Each API key has a configurable daily request limit (default: 10,000 requests/day). When exceeded, you receive a 429 RATE_LIMITED response. The limit resets at midnight UTC.

Available endpoints

Resource	Methods	Permission
/products	GET, POST, PUT, DELETE	products
/orders	GET, POST	orders
/customers	GET, POST, PUT, DELETE	customers
/inventory	GET, POST	inventory
/invoices	GET, POST, PUT	invoices
/loyalty/*	GET, POST	loyalty
/analytics/*	GET	analytics
/ai/analyze	POST	ai
/webhooks	GET, POST, PUT, DELETE	- (any key)

Idempotency

For POST requests that create resources (orders, invoices, customers, etc.), you can include an X-Idempotency-Key header to safely retry requests without creating duplicates. If a request with the same idempotency key and body has already been processed, the API returns the cached response instead of creating a new resource.

See the Idempotency guide for full details on how deduplication works, conflict handling, and best practices.