API reference

Endpoints. Examples. Edge cases.

Base URL: https://modules.etechflow.com/api/v1. All responses JSON, all errors RFC 7807 problem+json. Auth via Bearer token from Account → API access.

API overview

POST/licenses/validate

Validate a license key

Used by every Magento module on customer stores. Public endpoint, rate-limited 60/min per IP and 30/min per key. Returns 200 with status + expiry on success, 404 on unknown key, 403 on revoked/expired.

Example

curl -X POST https://modules.etechflow.com/api/v1/licenses/validate \
  -H 'content-type: application/json' \
  -d '{
    "key": "ETF-XXXX-XXXX-XXXX",
    "module_slug": "ai-cart-recovery",
    "domain": "shop.example.com"
  }'

Response

{
  "valid": true,
  "module_slug": "ai-cart-recovery",
  "tier": "lifetime",
  "support_expires_at": "2027-05-15",
  "support_active": true
}

GET/me/modules

List my modules

Authenticated. Returns all active licences for the calling account, including download URLs (signed, 15-minute expiry) and changelog summaries.

Example

curl https://modules.etechflow.com/api/v1/me/modules \
  -H 'authorization: Bearer YOUR_TOKEN'

Response

{
  "items": [
    {
      "module_slug": "ai-cart-recovery",
      "name": "AI Cart Recovery",
      "license_key": "ETF-XXXX-XXXX-XXXX",
      "tier": "lifetime",
      "support_expires_at": "2027-05-15",
      "latest_version": "1.4.2",
      "download_url": "https://modules.etechflow.com/d/..."
    }
  ]
}

POST/webhooks (your endpoint)

Webhook payload

We POST to your URL whenever an event you've subscribed to fires. Headers: X-ETF-Signature (HMAC-SHA256 of body using your secret), X-ETF-Event, X-ETF-Delivery-Id. Retry policy: 5 attempts, exponential back-off.

Example

POST https://your.app/webhooks/etf
content-type: application/json
x-etf-event: order.completed
x-etf-signature: sha256=...
x-etf-delivery-id: 01H...

Response

{
  "event": "order.completed",
  "occurred_at": "2026-05-16T11:42:00Z",
  "data": {
    "order_id": "ord_01H...",
    "customer_email": "buyer@example.com",
    "module_slug": "ai-cart-recovery",
    "tier": "subscription",
    "amount": "199.00",
    "currency": "GBP"
  }
}

Error format

We follow RFC 7807 for errors:

{
  "type": "https://modules.etechflow.com/errors/rate-limited",
  "title": "Rate limited",
  "status": 429,
  "detail": "60 requests/min per IP exceeded; retry after 28s.",
  "retry_after_seconds": 28
}

Need an endpoint that isn't here? Email api@etechflow.com. We triage requests weekly.

Validate a license key

Example

curl -X POST https://modules.etechflow.com/api/v1/licenses/validate \ -H 'content-type: application/json' \ -d '{ "key": "ETF-XXXX-XXXX-XXXX", "module_slug": "ai-cart-recovery", "domain": "shop.example.com" }'

Response

{ "valid": true, "module_slug": "ai-cart-recovery", "tier": "lifetime", "support_expires_at": "2027-05-15", "support_active": true }

List my modules

Authenticated. Returns all active licences for the calling account, including download URLs (signed, 15-minute expiry) and changelog summaries.

Example

curl https://modules.etechflow.com/api/v1/me/modules \ -H 'authorization: Bearer YOUR_TOKEN'

Response

{ "items": [ { "module_slug": "ai-cart-recovery", "name": "AI Cart Recovery", "license_key": "ETF-XXXX-XXXX-XXXX", "tier": "lifetime", "support_expires_at": "2027-05-15", "latest_version": "1.4.2", "download_url": "https://modules.etechflow.com/d/..." } ] }

Webhook payload

Example

POST https://your.app/webhooks/etf content-type: application/json x-etf-event: order.completed x-etf-signature: sha256=... x-etf-delivery-id: 01H...

Response

{ "event": "order.completed", "occurred_at": "2026-05-16T11:42:00Z", "data": { "order_id": "ord_01H...", "customer_email": "buyer@example.com", "module_slug": "ai-cart-recovery", "tier": "subscription", "amount": "199.00", "currency": "GBP" } }

{ "type": "https://modules.etechflow.com/errors/rate-limited", "title": "Rate limited", "status": 429, "detail": "60 requests/min per IP exceeded; retry after 28s.", "retry_after_seconds": 28 }