REST API

Authentication

How to authenticate with the Elexess REST API.

Most REST endpoints require authentication via either JWT or API token, depending on endpoint type.

API Token (Recommended)

Use your team API token in the Authorization header:

curl "https://api.elexess.com/functions/v1/search?searchterm=LM358" \
  -H "Authorization: Bearer el_live_YOUR_TOKEN"

API tokens:

Start with el_live_
Are tied to your team (pricing and rate limits apply to the team)
Can be created and revoked from Dashboard -> API Tokens
Track last_used_at for auditing
Are read-only unless created with write scopes

An ERP that cannot host a connector can push its data with a team API token instead. Team admins choose the scopes when they create the token; they cannot be changed later, so revoke the token and create a new one to change them.

Scope	Allows
`items:write`	Push items with `POST /functions/v1/items` and remove them with `DELETE`
`events:write`	Send item events to the team's integration without a signature (`POST /functions/v1/integration-events/{integration_id}`)

Pushed items are managed by your integration, like connector items: newer versions win, and items and part numbers your team entered are never overwritten. A token without the scope a request needs gets 403 with code: "insufficient_scope". Every token, with or without write scopes, can also read and search like a read-only token, so treat it as a secret of the same weight.

Session Token (JWT)

If you're building an application for a signed-in Elexess user, you can use the user's session JWT:

curl "https://api.elexess.com/functions/v1/search?searchterm=LM358" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

The JWT is automatically resolved to your user and team.

Which Token Type To Use

Use team API tokens (el_live_*) for server-to-server integrations and read-only API access, and with write scopes for ERP pushes.
Use JWT for user-scoped operations and all other write operations.

Other write endpoints are JWT-only to preserve created_by / updated_by user audit behavior.

For external integrations, always send a valid Authorization: Bearer ... token. Public/anonymous endpoint access is available only on explicitly public endpoints.

Endpoint Auth Matrix

/functions/v1/search: read with JWT or API token, no write method
/functions/v1/exchange-rate: public, no auth required
/functions/v1/ping: public, no auth required
/functions/v1/supplier-status and /functions/v1/supplier-incidents: public, no auth required
/functions/v1/watchlist: GET with JWT or API token, POST/DELETE with JWT only
/functions/v1/parts: read with JWT or API token, no write method
/functions/v1/items: GET with JWT or API token, POST/DELETE with an API token that has items:write
/functions/v1/integration-events/{integration_id}: a signed event, or an API token of the team that has events:write
/functions/v1/team-part: write with JWT only
/functions/v1/manufacturers: read with JWT or API token, no write method
/functions/v1/suppliers: read with JWT or API token, no write method
https://www.elexess.com/mcp: MCP server for AI assistants; reads with a user access token or API token, writes with a user access token only

Public Endpoint

The Exchange Rates API, Ping Endpoint, and Supplier Status Endpoint are publicly available and do not require authentication.

Part Detail Page

The buyer cockpit for any electronic component, with pricing, stock, attributes, and supply health at a glance.

Supplier Status Endpoint