Overview

The 3 Clicks API enables external systems to securely interact with your 3 Clicks environment using RESTful endpoints. This guide outlines authentication, request formats, and links to module workflow guides.

Getting Started

• Contact your 3 Clicks administrator to obtain your API Key and API Secret

• Access Swagger UI (interactive API documentation) at:
  https://[your-api-domain]/api-user-doc
• Base URL for API requests:
  https://[your-api-domain]/api-user/v1/

API module guides

Step-by-step workflow guides by module. Swagger UI remains the schema source of truth for request and response fields.

Request and Response Format

All API requests should use standard REST conventions with the following specifications:

• Use JSON in the request body (for POST, PUT, PATCH, DELETE)
• Include the header: Content-Type: application/json when sending a body

Example Request

curl -X 'PUT' \
  'https://[your-api-domain]/api-user/v1/style/ecommerce/tags-create' \
  -H 'accept: */*' \
  -H 'Content-Type: application/json' \
  -H 'X-Api-Key: your-api-key' \
  -H 'X-Api-Signature: your-signature' \
  -H 'X-Api-Timestamp: 1717128481' \
  -d '{
    "style_number": "A00416",
    "name": "Activewear"
  }'

Example Response

{
  "result": {
    "success": true,
    "code": "0",
    "message": "operate successfully."
  },
  "content": null
}

URL Encoding

When a parameter is included in the URL, ensure it is properly encoded.

Example:
If the parameter value is ABC/123, encode it as ABC%2F123:

/api-user/v1/shipping/basic/ABC%2F123

Authentication

The server accepts two authentication modes. Both use the same API key and secret issued by your administrator.

Simple auth (GET-friendly)

Send both headers on every request. No signature is required.

• X-Api-Key: your API key
• X-Api-Secret: your API secret

Use this mode for curl scripts, quick GET probes, and integrations that prefer sending the secret directly.

curl -X 'GET' \
  'https://[your-api-domain]/api-user/v1/style/basic/detail?style_number=SO00123' \
  -H 'accept: */*' \
  -H 'X-Api-Key: your-api-key' \
  -H 'X-Api-Secret: your-api-secret'

Strict auth (recommended for writes)

Send these headers. The API secret is not transmitted — it is used only on the client to compute the signature.

• X-Api-Key: your API key
• X-Api-Signature: the HMAC-SHA256 signature (lowercase hex)
• X-Api-Timestamp: current Unix timestamp in seconds

Use this mode for production integrations and for Try it out in Swagger UI: click Authorize, enter both key and secret; Swagger computes the signature and sends key, signature, and timestamp only.

curl -X 'GET' \
  'https://[your-api-domain]/api-user/v1/style/basic/detail?style_number=SO00123' \
  -H 'accept: */*' \
  -H 'X-Api-Key: your-api-key' \
  -H 'X-Api-Signature: your-signature' \
  -H 'X-Api-Timestamp: 1717127589'

Signature verification (strict auth)

Step 1: Prepare the data

Fields required:

• api_key
• api_secret
• method — HTTP verb in lowercase when building the signature message (e.g. get, post, put). Curl examples may show uppercase (GET, POST); only the value concatenated into the signature string must be lowercase.
• data — for GET, a JSON string of query parameters; for POST/PUT/PATCH/DELETE, the JSON request body string (use {} or the exact payload; no extra whitespace)
• timestamp — Unix time in seconds

Concatenate all values (no separators):

[api_key][api_secret][method][data][timestamp]

Step 2: Generate signature

Use HMAC with SHA256 encryption:

String secretKey = "your-api-secret";
String message = "your-message-to-sign";

Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
SecretKeySpec secret_key = new SecretKeySpec(secretKey.getBytes(), "HmacSHA256");
sha256_HMAC.init(secret_key);

byte[] hash = sha256_HMAC.doFinal(message.getBytes());
String signature = Hex.encodeHexString(hash);

Troubleshooting