Customized CTIT Edition | REST | JSON | JWT

Connect your product through CTIT Gateway

Start from the gateway setup: create an Application, set scopes, then use the credentials to call the APIs. We provide the server URL and login details.

Step 1Create Application

Step 2Scopes & fields

Step 3Copy credentials

Step 4Login & call APIs

Applicationcreate in gateway

Scopesmodels & fields

Credentialsclient_id / secret

Call APIslogin → data

What is the API Gateway?

A secure REST layer for your backend systems. Mobile apps, websites, partner portals, and backend services connect via HTTPS JSON and JWT - never directly to the database.

Important order

Integration always starts from gateway setup: create an Application, configure scopes, then share credentials. Without an Application, login returns invalid_client.

What we validate

Application credentials
User identity (JWT)
Scopes (models / fields)
Rate limits & audit

Who it’s for

Gateway admins (setup) and integrators building any client: mobile, web, or partner systems.

Connection details

To connect your app or system, contact us. We provide your environment details — nothing is public by default.

Item	What we provide
base_url	Server URL (no trailing slash)
Database	Database name (for reference / support)
login / password	API user credentials
client_id / client_secret	From Application credentials (after gateway setup)

Web UI: {{base_url}}/web/login
API login: POST {{base_url}}/api/v1/auth/login

Important

Do not guess URLs or credentials. We provide base_url, database, user, password, client_id, and client_secret before you start development.

Gateway setup - create an Application

Do this first before any client coding.

Open API Gateway → Applications.

Click New and set a clear name (e.g. Mobile App).

Keep Active = ON. Optionally set Rate Policy and CORS.

Save - the system auto-generates client_id, client_secret, and JWT secret.

Credentials tab

Field	What to do
client_id	Copy - public app ID
client_secret	Copy securely - used only at login
access_token_ttl_minutes	Default 15
refresh_token_ttl_days	Default 14

Scopes & fields

Without scopes the app can login, but data APIs return permission errors.

Open Application → Scopes & Permissions → Add.

Choose model (e.g. res.partner).

Enable Read / Create / Write / Delete / Call as needed.

Select allowed read and write fields.

Set max limit per request and optional domain filter.

Extra settings

Custom Calls

App Screens & Users

Map screen keys to users for menu-access.

Blocked Users

Blocked users cannot login or call this app.

Audit Logs

API Gateway → Audit Logs for debugging.

Share with the integrator

Item	Notes
base_url	We provide the server URL
Database	Database name (we provide)
client_id	From Credentials tab
client_secret	Secret - share privately
User login + password	Active user

Integration flow

Setup: Create Application + Scopes → share client_id / client_secret / user → POST /api/v1/auth/login → access_token + refresh_token → /api/v1/info/* & /api/v1/data/* with Authorization: Bearer ... + X-Client-Id

Authenticate

Login

POST{{base_url}}/api/v1/auth/login

REQUESTJSON

{
  "client_id": "YOUR_CLIENT_ID",
  "client_secret": "YOUR_CLIENT_SECRET",
  "login": "user@company.com",
  "password": "******"
}

Persist

access_token | refresh_token | expires_in | user.id

Refresh

POST/api/v1/auth/refresh

REQUESTJSON

{
  "client_id": "YOUR_CLIENT_ID",
  "refresh_token": "CURRENT_REFRESH_TOKEN"
}

Revoke (logout)

POST/api/v1/auth/revoke

Request headers

Header	Value
Authorization	Bearer
X-Client-Id
Content-Type	application/json

Discover permissions

GET/api/v1/info/models

GET/api/v1/info/models/{model}/fields

GET/api/v1/info/methods

Rule

Only write fields listed in write_fields.

Read & write data

Base path: /api/v1/data/{model}

GET/api/v1/data/res.partner?limit=20&lang=ar

POST/api/v1/data/res.partner

CREATEJSON

{
  "values": {
    "name": "New Customer",
    "email": "new@example.com"
  }
}

PATCH/api/v1/data/res.partner/55

DELETE/api/v1/data/res.partner/55

POST/api/v1/data/{model}/{id}/call/{slug}

Endpoint reference

Method	Path	Purpose
POST	/api/v1/auth/login	Login
POST	/api/v1/auth/refresh	Refresh
POST	/api/v1/auth/revoke	Revoke
GET	/api/v1/info/models	Models
GET	/api/v1/info/models/{model}/fields	Fields
GET	/api/v1/data/{model}	List
GET	/api/v1/data/{model}/{id}	Read
POST	/api/v1/data/{model}	Create
PATCH	/api/v1/data/{model}/{id}	Update
DELETE	/api/v1/data/{model}/{id}	Delete

Postman collection (full)

Full collection with 4 folders and 34 requests: 1. Authentication (Login, Refresh, Revoke + error examples), 2. Metadata & Discovery (models, fields, methods, menu-access), 3. Generic CRUD (partners, products, sale orders), 4. Sale Order - Business Automation (confirm, picking, invoice, payment, process_operations). Login Test script auto-saves access_token and refresh_token.

Variable	Purpose
base_url	We provide the server URL
client_id / client_secret	From Application credentials
login / password	System user
model / record_id	Data CRUD targets
method_slug / menu_key	Custom call & menu-access

Create app & Postman

Go-live checklist

Created Application in gateway setup
Configured scopes (model + fields + operations)
Shared base_url, client_id, client_secret
Login returns tokens + user
Protected calls send Authorization + X-Client-Id
401 triggers refresh + single retry

Need access?

We provide base_url, database, user, password, and API credentials — contact us to get started.

Downloads

PDF (login) Postman (login)