Gorvado API for CRM and ERP

Quick start

1. Open Account → API and integrations and create a key (read, or read + write).
2. Send it in every request: Authorization: Bearer gv_live_…
3. All requests and responses are JSON over HTTPS. Base URL: https://gorvado.com/api/v1

curl https://gorvado.com/api/v1/me \
  -H "Authorization: Bearer gv_live_XXXXXXXX"

Endpoints

Import products from your CRM / ERP

Send your own ID as external_id (CRM ID or SKU) — the same call creates the product the first time and updates it next time. New products are drafts; add "submit": true and at least one photo to send them to moderation. Published products update right away.

curl -X POST https://gorvado.com/api/v1/products \
  -H "Authorization: Bearer gv_live_XXXXXXXX" -H "Content-Type: application/json" \
  -d '{
    "external_id": "SKU-1042",
    "title": "Nitrile gloves, box of 100",
    "category": "safety-equipment",
    "description": "Powder-free, 4 mil, sizes S–XL.",
    "condition": "New",
    "price": 6.4, "unit": "cases", "quantity": 1200, "moq": 20,
    "price_tiers": [{ "min_quantity": 100, "price": 5.9 }, { "min_quantity": 500, "price": 5.5 }],
    "city": "Dallas", "state": "TX", "zip": "75201", "terms": "FOB",
    "payment_methods": ["ach", "wire_transfer"], "delivery_methods": ["freight", "pickup"], "pickup_zip": "75201", "shipping_cost_type": "calculated_separately",
    "attributes": { "model_sku": "NG-100" },
    "photos": ["https://cdn.yourshop.com/ng-100.jpg"],
    "submit": true
  }'

Sync many at once: send an array of up to 100 products (response 207 with a result per item). Stock-only update: PATCH /api/v1/products/ext:SKU-1042 {"quantity": 950}. Payment methods: cash, ach, wire_transfer, check, credit_debit_card, other. Delivery: pickup, seller_delivery, freight, parcel, other. Photos: public https JPG / PNG / WebP up to 10 MB; sending photos replaces all photos.

Export leads and buyer contacts

GET /api/v1/conversations?updated_since=2026-11-01T00:00:00Z returns your leads. Every lead has a buyer block with the company, city and state. Email and phone are included only after your company opened the buyer's contact details (free for inbound contacts, 1 Buyer Access Credit for outbound) and only if the buyer shares them. The API never spends credits — open contacts on the website. Use buyer details only for that business inquiry (no spam, no resale).

{
  "data": [{
    "id": "cm3…", "type": "inbound",
    "buyer": { "key": "company:cm2…", "company": "Bright Retail LLC", "city": "Dallas", "state": "TX",
               "contacts": { "name": "Chris Parker", "email": "chris@…", "phone": "+1 214…", "access": "inbound" } },
    "product": { "id": "cm1…", "title": "Nitrile gloves, box of 100" },
    "last_message": { "from": "buyer", "body": "Can you do 300 cases?", "created_at": "2026-11-13T15:02:11Z" }
  }],
  "has_more": false, "next_cursor": null
}

Webhooks

Add an https endpoint in Account → API and integrations. We POST JSON and retry once on failure.

• message.created — A buyer sent your company a message (new lead or reply)
• offer.decided — A buyer accepted or declined your offer
• request.matched — A new buying request in your categories
• product.status_changed — A product was approved, sent back or rejected by moderation
• product.expiring — A product expires in 7 or 2 days
• billing.updated — Your plan or payment status changed

POST https://hooks.yourcrm.com/gorvado
X-Gorvado-Event: message.created
X-Gorvado-Signature: t=1763046000,v1=5f2c…

{ "id": "evt_…", "event": "message.created", "created": "2026-11-13T15:02:11Z",
  "data": { "title": "Nitrile gloves, box of 100", "from": "Bright Retail LLC",
            "conversationId": "cm3…", "url": "https://gorvado.com/messages/cm3…" } }

Verify the signature: compute HMAC-SHA256 of `${t}.${rawBody}` with your signing secret and compare it with v1; reject events older than 5 minutes. Then fetch details with the API (e.g. the conversation's messages).

// Node.js
const [t, v1] = req.headers['x-gorvado-signature'].split(',').map((p) => p.split('=')[1]);
const ok = crypto.timingSafeEqual(
  Buffer.from(v1, 'hex'),
  crypto.createHmac('sha256', process.env.GORVADO_WEBHOOK_SECRET).update(`${t}.${rawBody}`).digest()
) && Math.abs(Date.now() / 1000 - Number(t)) < 300;

Scheduled sync (no code)

In Account → API and integrations → Scheduled sync choose what to sync, a URL, how often (every hour, every 6 hours, every day or chosen days), the time and your time zone, and tick Automatic.Import: Gorvado downloads your CSV, Excel or JSON file (e.g. a stock export from your ERP or a published Google Sheet) and updates products matched by external_id / sku — only existing ones, or also new ones.Export: Gorvado POSTs new and changed products, leads, contacts, offers or buying requests to your URL in signed JSON batches of up to 200 records. “Run now” starts a sync immediately; every run is in the history with counts and errors.

sku,quantity,price
SKU-1042,950,6.20
SKU-1043,0,7.10

Rules

• Pagination: limit (up to 100) and cursor = next_cursor from the previous page. updated_since for incremental sync.
• Rate limit: 120 requests per minute per key (HTTP 429).
• Errors: { "error": { "code": "validation_error", "message": "…", "field": "price" } } — 400 bad JSON, 401 bad key, 402 no plan with API access, 403 missing scope, 404, 409, 422 validation, 429.
• Products follow the same posting rules as the website (no contacts in titles and descriptions, prohibited items, moderation of new listings).
• Keys belong to your company. Revoke a key in your account if it leaks.