How to Connect to the Unleashed API (Authentication, Signatures and Paging)

Call the Unleashed inventory API from a workflow: find your API ID and key, generate the HMAC-SHA256 signature Unleashed requires on every request, and page through products, stock on hand and sales orders.

What This Integration Does

Unleashed's API does not use a simple bearer token. Every request must carry your API ID and a signature: an HMAC-SHA256 hash of the request's query string, keyed with your API key and Base64-encoded. This is the step that trips most people up. In Spojit you generate the signature with the Encoding Tools connector's hmac tool and send the request with the HTTP Requests connector, so no custom code or proxy is needed. Once the pattern is in place, any Unleashed endpoint (Products, StockOnHand, SalesOrders, PurchaseOrders, Customers) is one signed call away.

This tutorial builds a reusable read: a scheduled workflow that fetches every page of stock on hand and makes it available to later steps. Reading is safe to repeat. The same signing steps work for POST requests that create sales orders or purchase orders, which the Tips cover.

Prerequisites

• An Unleashed account with API access. Find your API ID and API Key on the API Access page in Unleashed (Unleashed's "Unleashed API access" help article shows where it is for your plan). Use a dedicated user with only the permissions the integration needs.
• Nothing else to install: Encoding Tools and HTTP Requests are built in.

How the Signature Works

For each request, Unleashed expects these headers:

• api-auth-id: your API ID.
• api-auth-signature: Base64 of HMAC-SHA256(query string, API key). The query string is everything after the ?, without the ? itself. For a request with no query string, sign an empty string.
• client-type: a label for your integration in the form account_name/app_name, for example acme/spojit.
• Accept and Content-Type: application/json.

The path is not part of the signature; only the query string is. So /StockOnHand/2?pageSize=200 is signed as pageSize=200.

Step 1: Schedule Trigger

Add a Trigger node with type Schedule, for example */30 * * * * for stock or 0 6 * * * for a daily product sync.

Step 2: Sign the Query String

Add a Connector node on Encoding Tools in Direct Mode with hmac:

• text: pageSize=200 (exactly the query string you will send).
• secret: your Unleashed API key.
• algorithm: sha256
• encoding: base64

Name the output sig. The signature is in {{ sig.hash }}.

Step 3: Call the Endpoint

Add a Connector node on HTTP Requests with http-get:

• url: https://api.unleashedsoftware.com/StockOnHand/{{ page }}?pageSize=200
• headers:

  {
    "Accept": "application/json",
    "Content-Type": "application/json",
    "api-auth-id": "YOUR_API_ID",
    "api-auth-signature": "{{ sig.hash }}",
    "client-type": "acme/spojit"
  }

Name the output stock. The body is in {{ stock.data }}: a Pagination object (PageNumber, NumberOfPages, NumberOfItems) and an Items array with fields such as ProductCode, ProductDescription, QtyOnHand, AllocatedQty and AvailableQty.

Step 4: Page Through Every Result

Unleashed puts the page number in the path (/StockOnHand/1, /StockOnHand/2), so the query string, and therefore the signature, stays the same on every page. Put Step 3 in a Loop in While mode: start page at 1, collect Items from each response, and continue while PageNumber is less than NumberOfPages. Set Max iterations to a safe ceiling such as 100. Name the collected list all_stock.

Step 5: Use the Data

From here the stock list can go anywhere: compare it with your store and update quantities (see the "How to Sync Unleashed Stock Levels to Shopify" tutorial in this help center), load it into MySQL for reporting, or ask an Agent Mode step to flag products below their reorder point and post them to Slack.

Tips

• Filters change the signature: adding &warehouseCode=MAIN or &modifiedSince=2026-10-01 changes the query string, so the hmac text must change to match, character for character and in the same order.
• Incremental reads: many endpoints accept modifiedSince. Sign and send modifiedSince=YYYY-MM-DD&pageSize=200 to fetch only records changed since your last run.
• Creating records: for POST requests such as creating a sales order, the signature still covers only the query string. With no query string, sign an empty string and send the JSON body with http-post.
• Reuse: put Steps 2 to 4 in their own workflow and call it with a Subworkflow node, passing the endpoint and query, so every Unleashed integration shares one signing routine.

Common Pitfalls

• Signing the whole URL: including the domain, the path or the ? in the signed text gives a 403. Sign only what comes after the ?.
• Hex instead of Base64: the hmac tool defaults to hex. Unleashed needs base64.
• Encoding differences: if a filter value contains spaces or special characters, sign the same URL-encoded form you send. The Encoding Tools url-encode tool produces it.
• Key in the workflow: the API key sits in the hmac step's configuration. Use a dedicated API user and rotate the key if a workflow export is ever shared.

Testing

Run the workflow manually with pageSize=5 (in both the signed text and the URL) and check that the HTTP step returns 200 with five items. A 403 almost always means the signed text and the sent query string differ. Then raise the page size and enable the loop.

Learn More

• Encoding Tools documentation (hmac)
• HTTP Requests connector documentation
• Subworkflow node documentation