{"activeVersionTag":"latest","latestAvailableVersionTag":"latest","collection":{"info":{"_postman_id":"983c092a-609a-42cf-8a6f-4fd12a7c5262","name":"BioTrack Web Public API","description":"The BioTrack Web public API for integration partners: e-commerce and ordering platforms, loyalty and marketing tools, and payment providers working with BioTrack Web dispensaries.\n\n## Base URLs\n\n| Environment | Base URL |\n|---|---|\n| Sandbox (UAT) | `https://uat-api.biotrackweb.com` |\n| Production | `https://api.biotrackweb.com` |\n\nSet the `baseUrl` variable to the one you are working against. Every path starts with the API version, `/v1`.\n\n## Getting access\n\nA dispensary organization connects your integration in BioTrack Web, enables the facilities (stores) you may reach, and BioTrack Web issues you a **client id** (`btwc_…`) and **client secret** (`btws_…`) for that connection. Each organization you work with has its own credential, and a credential only ever reaches its own organization.\n\nA credential can be issued for the whole organization or for one facility. Credentials are rotated with a 24-hour overlap, so you can switch to the new one without downtime.\n\n## Authentication\n\n1. Exchange the credential for an access token: `POST /v1/oauth/token` (OAuth 2.0 client credentials).\n2. Send the token on every call: `Authorization: Bearer <access_token>`.\n3. Request a new token before `expires_in` (15 minutes) runs out. There are no refresh tokens.\n\nA token is either for the **organization** or bound to **one facility** (`facility_id` on the token request). URLs never contain a facility id: the token decides which facility a request is about.\n\nAccess is checked live on every call: if the organization switches your connection off, disables a facility or revokes your credential, your next call is refused.\n\n## Using this collection\n\nSet `clientId` and `clientSecret` (in an environment, or the collection variables). The collection fetches a token automatically before the first call, and again when it expires. You can also run the *Authentication* requests yourself.\n\n## Errors\n\nEvery error has the same body, except the token endpoint's (see below):\n\n```json\n{\n  \"error\": {\n    \"code\": \"facility_not_available\",\n    \"message\": \"the facility is not available to this connection\",\n    \"field\": \"id\",\n    \"requestId\": \"34e8a819c80ed5e5fee91666d35671f5\"\n  }\n}\n```\n\nBranch on `code`; `message` is for people and may change. `field` names the request field at fault, when there is one. `requestId` is also in the `X-Request-Id` response header: quote it when you contact support. You can send your own `X-Request-Id` (up to 64 letters, digits, `-`, `_`, `.`) and we use it.\n\nThe token endpoint answers in the OAuth 2.0 error format ([RFC 6749 § 5.2](https://www.rfc-editor.org/rfc/rfc6749#section-5.2)), which client libraries expect: `{\"error\": \"invalid_client\", \"error_description\": \"…\", \"request_id\": \"…\"}`.\n\n| Status | `code` | Meaning |\n|---|---|---|\n| 400 | `invalid_request` | the request is malformed or misses a required field |\n| 400 | `unsupported_grant_type` | only `client_credentials` is supported |\n| 401 | `invalid_client` | unknown client id, wrong secret, or a revoked or expired credential |\n| 401 | `invalid_token` | missing or invalid bearer token, or its credential was revoked |\n| 401 | `token_expired` | request a new token |\n| 403 | `integrator_suspended` | BioTrack Web has suspended your integration |\n| 403 | `connection_disabled` | the organization switched your connection off |\n| 403 | `organization_unavailable` | the organization is not active |\n| 403 | `facility_not_available` | the facility is not enabled for your connection |\n| 400 | `facility_required` | this endpoint reads store data: request a token with `facility_id` |\n| 403 | `capability_not_granted` | your connection does not include this capability |\n| 404 | `not_found` | no such resource for this token, or no such endpoint |\n| 429 | `rate_limited` | wait `Retry-After` seconds |\n| 502 | `internal` | a temporary problem on our side; retry with backoff |\n\n## Rate limits\n\nEach connection (one organization) may make **10 requests per second** across the API, shared by all its credentials and tokens: rotating a credential or using facility tokens does not add to it. Token requests are limited separately (20 per minute per client id). Every response carries:\n\n| Header | |\n|---|---|\n| `RateLimit-Limit` | requests allowed in the current window |\n| `RateLimit-Remaining` | requests left in it |\n| `RateLimit-Reset` | seconds until the window resets |\n\nOver the limit you get `429 rate_limited` with `Retry-After` (seconds). There is no lockout: wait and continue. Talk to us if your volume needs a higher limit.\n\n## Conventions\n\n- JSON, UTF-8. Field names are camelCase, except in the OAuth token response, which follows the standard.\n- Ids are opaque strings; don't parse them.\n- Times are RFC 3339 in UTC (`2026-10-22T18:27:35Z`).\n- Lists return `{\"data\": [...], \"nextCursor\": null}`; pass `nextCursor` back as `cursor` for the next page.\n- We add fields and endpoints within `/v1` without notice: ignore what you don't recognize. Removing or changing anything is a new version, announced in advance.\n","schema":"https://schema.getpostman.com/json/collection/v2.0.0/collection.json","isPublicCollection":false,"owner":"23817735","team":4155519,"collectionId":"983c092a-609a-42cf-8a6f-4fd12a7c5262","publishedId":"2sBYHYscfm","public":true,"publicUrl":"https://api-doc.biotrackweb.com","privateUrl":"https://go.postman.co/documentation/23817735-983c092a-609a-42cf-8a6f-4fd12a7c5262","customColor":{"top-bar":"FFFFFF","right-sidebar":"242826","highlight":"1A4FCB"},"documentationLayout":"classic-double-column","customisation":{"metaTags":[{"name":"description","value":"The BioTrack Web public API for integration partners: e-commerce and ordering platforms, loyalty and marketing tools, and payment providers working with BioTrack Web dispensaries."},{"name":"title","value":""}],"appearance":{"default":"light","themes":[{"name":"dark","logo":"https://content.pstmn.io/a8ea2d2c-8bb5-45be-acb6-ccc9390dac38/YmlvdHJhY2std29yZG1hcmstcmV2ZXJzZWQucG5n","colors":{"top-bar":"111312","right-sidebar":"242826","highlight":"5AA0FF"}},{"name":"light","logo":"https://content.pstmn.io/444f3bf9-357c-4733-943f-be28a9a07760/YmlvdHJhY2std29yZG1hcmsucG5n","colors":{"top-bar":"FFFFFF","right-sidebar":"242826","highlight":"1A4FCB"}}]}},"version":"8.12.11","publishDate":"2026-11-05T03:20:02.000Z","activeVersionTag":"latest","documentationTheme":"light","metaTags":{"title":"","description":"The BioTrack Web public API for integration partners: e-commerce and ordering platforms, loyalty and marketing tools, and payment providers working with BioTrack Web dispensaries."},"logos":{"logoLight":"https://content.pstmn.io/444f3bf9-357c-4733-943f-be28a9a07760/YmlvdHJhY2std29yZG1hcmsucG5n","logoDark":"https://content.pstmn.io/a8ea2d2c-8bb5-45be-acb6-ccc9390dac38/YmlvdHJhY2std29yZG1hcmstcmV2ZXJzZWQucG5n"}},"statusCode":200},"environments":[{"name":"BioTrack Web Public API — Production","id":"b2a0afbb-87b0-470f-b364-57b4e9f8433c","owner":"58227635","values":[{"key":"","value":"","enabled":false,"type":"default","secret":true},{"key":"baseUrl","value":"https://api.biotrackweb.com","enabled":true,"type":"default"},{"key":"clientId","value":"","enabled":true,"type":"default"},{"key":"clientSecret","value":"","enabled":true,"type":"default"}],"published":true}],"user":{"authenticated":false,"permissions":{"publish":false}},"run":{"button":{"js":"https://run.pstmn.io/button.js","css":"https://run.pstmn.io/button.css"}},"web":"https://www.getpostman.com/","team":{"logo":"https://res.cloudinary.com/postman/image/upload/t_team_logo_pubdoc/v1/team/62d65d77a68bf4e35878c8cb85e01079de959b4315afe6eba18eb4790270b9db","favicon":"https://biotrackweb.com/favicon.ico"},"isEnvFetchError":false,"languages":"[{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"HttpClient\"},{\"key\":\"csharp\",\"label\":\"C#\",\"variant\":\"RestSharp\"},{\"key\":\"curl\",\"label\":\"cURL\",\"variant\":\"cURL\"},{\"key\":\"dart\",\"label\":\"Dart\",\"variant\":\"http\"},{\"key\":\"go\",\"label\":\"Go\",\"variant\":\"Native\"},{\"key\":\"http\",\"label\":\"HTTP\",\"variant\":\"HTTP\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"OkHttp\"},{\"key\":\"java\",\"label\":\"Java\",\"variant\":\"Unirest\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"Fetch\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"jQuery\"},{\"key\":\"javascript\",\"label\":\"JavaScript\",\"variant\":\"XHR\"},{\"key\":\"c\",\"label\":\"C\",\"variant\":\"libcurl\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Axios\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Native\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Request\"},{\"key\":\"nodejs\",\"label\":\"NodeJs\",\"variant\":\"Unirest\"},{\"key\":\"objective-c\",\"label\":\"Objective-C\",\"variant\":\"NSURLSession\"},{\"key\":\"ocaml\",\"label\":\"OCaml\",\"variant\":\"Cohttp\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"cURL\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"Guzzle\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"HTTP_Request2\"},{\"key\":\"php\",\"label\":\"PHP\",\"variant\":\"pecl_http\"},{\"key\":\"powershell\",\"label\":\"PowerShell\",\"variant\":\"RestMethod\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"http.client\"},{\"key\":\"python\",\"label\":\"Python\",\"variant\":\"Requests\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"httr\"},{\"key\":\"r\",\"label\":\"R\",\"variant\":\"RCurl\"},{\"key\":\"ruby\",\"label\":\"Ruby\",\"variant\":\"Net::HTTP\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"Httpie\"},{\"key\":\"shell\",\"label\":\"Shell\",\"variant\":\"wget\"},{\"key\":\"swift\",\"label\":\"Swift\",\"variant\":\"URLSession\"}]","languageSettings":[{"key":"csharp","label":"C#","variant":"HttpClient"},{"key":"csharp","label":"C#","variant":"RestSharp"},{"key":"curl","label":"cURL","variant":"cURL"},{"key":"dart","label":"Dart","variant":"http"},{"key":"go","label":"Go","variant":"Native"},{"key":"http","label":"HTTP","variant":"HTTP"},{"key":"java","label":"Java","variant":"OkHttp"},{"key":"java","label":"Java","variant":"Unirest"},{"key":"javascript","label":"JavaScript","variant":"Fetch"},{"key":"javascript","label":"JavaScript","variant":"jQuery"},{"key":"javascript","label":"JavaScript","variant":"XHR"},{"key":"c","label":"C","variant":"libcurl"},{"key":"nodejs","label":"NodeJs","variant":"Axios"},{"key":"nodejs","label":"NodeJs","variant":"Native"},{"key":"nodejs","label":"NodeJs","variant":"Request"},{"key":"nodejs","label":"NodeJs","variant":"Unirest"},{"key":"objective-c","label":"Objective-C","variant":"NSURLSession"},{"key":"ocaml","label":"OCaml","variant":"Cohttp"},{"key":"php","label":"PHP","variant":"cURL"},{"key":"php","label":"PHP","variant":"Guzzle"},{"key":"php","label":"PHP","variant":"HTTP_Request2"},{"key":"php","label":"PHP","variant":"pecl_http"},{"key":"powershell","label":"PowerShell","variant":"RestMethod"},{"key":"python","label":"Python","variant":"http.client"},{"key":"python","label":"Python","variant":"Requests"},{"key":"r","label":"R","variant":"httr"},{"key":"r","label":"R","variant":"RCurl"},{"key":"ruby","label":"Ruby","variant":"Net::HTTP"},{"key":"shell","label":"Shell","variant":"Httpie"},{"key":"shell","label":"Shell","variant":"wget"},{"key":"swift","label":"Swift","variant":"URLSession"}],"languageOptions":[{"label":"C# - HttpClient","value":"csharp - HttpClient - C#"},{"label":"C# - RestSharp","value":"csharp - RestSharp - C#"},{"label":"cURL - cURL","value":"curl - cURL - cURL"},{"label":"Dart - http","value":"dart - http - Dart"},{"label":"Go - Native","value":"go - Native - Go"},{"label":"HTTP - HTTP","value":"http - HTTP - HTTP"},{"label":"Java - OkHttp","value":"java - OkHttp - Java"},{"label":"Java - Unirest","value":"java - Unirest - Java"},{"label":"JavaScript - Fetch","value":"javascript - Fetch - JavaScript"},{"label":"JavaScript - jQuery","value":"javascript - jQuery - JavaScript"},{"label":"JavaScript - XHR","value":"javascript - XHR - JavaScript"},{"label":"C - libcurl","value":"c - libcurl - C"},{"label":"NodeJs - Axios","value":"nodejs - Axios - NodeJs"},{"label":"NodeJs - Native","value":"nodejs - Native - NodeJs"},{"label":"NodeJs - Request","value":"nodejs - Request - NodeJs"},{"label":"NodeJs - Unirest","value":"nodejs - Unirest - NodeJs"},{"label":"Objective-C - NSURLSession","value":"objective-c - NSURLSession - Objective-C"},{"label":"OCaml - Cohttp","value":"ocaml - Cohttp - OCaml"},{"label":"PHP - cURL","value":"php - cURL - PHP"},{"label":"PHP - Guzzle","value":"php - Guzzle - PHP"},{"label":"PHP - HTTP_Request2","value":"php - HTTP_Request2 - PHP"},{"label":"PHP - pecl_http","value":"php - pecl_http - PHP"},{"label":"PowerShell - RestMethod","value":"powershell - RestMethod - PowerShell"},{"label":"Python - http.client","value":"python - http.client - Python"},{"label":"Python - Requests","value":"python - Requests - Python"},{"label":"R - httr","value":"r - httr - R"},{"label":"R - RCurl","value":"r - RCurl - R"},{"label":"Ruby - Net::HTTP","value":"ruby - Net::HTTP - Ruby"},{"label":"Shell - Httpie","value":"shell - Httpie - Shell"},{"label":"Shell - wget","value":"shell - wget - Shell"},{"label":"Swift - URLSession","value":"swift - URLSession - Swift"}],"layoutOptions":[{"value":"classic-single-column","label":"Single Column"},{"value":"classic-double-column","label":"Double Column"}],"versionOptions":[],"environmentOptions":[{"value":"0","label":"No Environment"},{"label":"BioTrack Web Public API — Production","value":"58227635-b2a0afbb-87b0-470f-b364-57b4e9f8433c"}],"canonicalUrl":"https://api-doc.biotrackweb.com/view/metadata/2sBYHYscfm"}