The Tropic API empowers you to programmatically manage your software procurement and spend optimization workflows. Built on REST principles, our API provides predictable, resource-oriented URLs and uses standard HTTP methods.
All requests and responses are JSON-encoded, with conventional HTTP response codes indicating the success or failure of each operation.
NOT A DEVELOPER? Tropic seamlessly connects with leading procurement, ERP, and financial systems through our native integrations. Start optimizing your software spend, automating renewals, and managing vendors without writing a single line of code.
View API Documentation | View Webhook Documentation
To access the full API and Webhook documentation, please log in to your Tropic account. Once logged in, you can find the full documentation in Settings -- API Keys & Webhooks under \"Reference\" at the top of the API Keys and Webhooks tables.
All Tropic API requests must be made against the following base URL:
Include this base URL before the endpoint path in every request.
Example:
GET https://app.tropicapp.io/api/v1/contracts
The API Keys & Webhooks page is designed to provide a self-service way for users with the Admin role to help set up and manage the API Keys and Webhooks.
Navigate to Settings > API Keys & Webhooks
You can view the list of API keys and webhooks in each respective tabs.
If you’re connecting the Tropic API through Okta Workflows, make sure your connection uses the correct authorization header. An incorrect header name will cause authentication to fail.
Use the following configuration in Okta Workflows:
Authorization\nBearer (token)\nImportant: Do not use bearer_auth as the header name. The Tropic API only accepts Authorization with the bearer token format.
API keys are unique identifiers used to authenticate your requests to the Tropic API. Think of them as passwords that allow our systems to verify your identity and grant appropriate access to API resources.
To generate a new API key:
To revoke a new API key:
Revoking an API key is not a reversible action, once a API key is revoked we can't set it to be active again.
The Webhook API enables real-time event-driven integrations with your existing systems and workflows. Built on industry-standard web protocols, our webhook system provides reliable event delivery, secure payload transmission, and easy-to-implement endpoint management. All webhook notifications are JSON-encoded, with detailed event types and comprehensive payload data to help you respond to changes instantly.
The API Keys & Webhooks page is designed to provide a self-service way for users with the Admin role to help set up and manage the API Keys and webhooks.
Navigate to Settings > API Keys & Webhooks
You can view the list of API Keys and webhooks in each respective tabs.
Webhooks enable seamless integration by allowing your application to be notified about changes or actions happening in the Tropic app, such as purchase request task status changes, or new contract being created. When you create a webhook, we automatically generate a unique secret key for that webhook. This secret can be used to verify that the requests you receive are authentic and originated from our application, enhancing security and ensuring the integrity of the data being shared.
To create a new webhook:
To verify that a webhook request is authentic and sent from the Tropic application, you can use the provided signature and the secret key associated with your webhook. Here’s how the verification process works:
To verify a webhook:
signed_payload = \"#{timestamp}.#{payload}\"expected_signature = OpenSSL::HMAC.hexdigest(\"SHA256\", YOUR_WEBHOOK_SECRET, signed_payload)Here's a snippet for performing the validation in Ruby:
timestamp = request.headers[\"Tropic-Timestamp\"]\npayload = request.body\nsigned_payload = \"#{timestamp}.#{payload}\"\nexpected_signature = OpenSSL::HMAC.hexdigest(\"SHA256\", YOUR_WEBHOOK_SECRET, signed_payload)\nif expected_signature == request.headers[\"Tropic-Signature\"]
\n# Request is verified\nelse
\n# Request is not authentic\nendThis process is consistent across programming languages, so developers can adapt it to their preferred stack while ensuring the security of the webhook integration.
Webhook name, URL and resource actions can be modified at any point, however the secret will not change even if a webhook's information is updated.
To edit a new webhook:
You can view API Logs and Webhook Events under Settings → API Keys & Webhooks.
API Logs: Track API activity with details like request date, method, path, status code, and error messages. Note that Payloads are not included in API Logs.
Webhook Events: View webhook event logs with timestamps and statuses. Clicking on an event lets you see the full payload for easier debugging.
The Tropic API uses rate limiting to maintain security and stability. If more than 50 requests per minute are sent, the API will return a 429 (Too Many Requests) response.
To ensure your integration continues to function as expected, we recommend implementing a retry mechanism with exponential backoff to reduce request volume when necessary.
The Tropic API provides various endpoints to help you manage procurement and spend workflows. Below are some commonly used examples:
Contracts:
GET /api/v1/contracts: Retrieves all contracts.\nPOST /api/v1/contracts: Creates a new contract.\nPUT /api/v1/contracts/{contract_id}: Updates a specific contract.\nPurchase Requests:
GET /api/v1/purchase_requests: Retrieves all purchase requests.PUT /api/v1/purchase_requests/{purchase_request_id}: Updates a specific purchase request.Comments:
GET /api/v1/purchase_requests/{purchase_request_id}/comments: Retrieves all comments for a purchase request.POST /api/v1/purchase_requests/{purchase_request_id}/comments: Adds a comment to a purchase request.Suppliers:
POST /api/v1/suppliers: Creates a new supplier.GET /api/v1/suppliers/search: Searches for suppliers by name or other parameters. Provide a query parameter with letters to narrow your search results.GET /api/v1/suppliers/{supplier_id}: Retrieves details of a specific supplier using their unique ID.PUT /api/v1/suppliers/{supplier_id}: Updates information for an existing supplier, such as name, contact details, or custom fields.Note: To see all of our endpoints, click here. If you have trouble viewing it, make sure you are signed into Tropic.
","user_segment_ids":[]}}