Build with Growmax ARC

Growmax ARC is a multi-tenant B2B revenue platform. A seller maintains a catalog, prices products, quotes customers, converts quotes to orders, fulfils orders, invoices, and collects payments. Your integration operates inside one seller workspace (an organization).

Authentication

User JWTs for GraphQL, tenant API keys for the Service API, OAuth for MCP.

First GraphQL request

Log in, read the catalog, and page with cursors.

First REST request

Call the Service API with an API key.

Core concepts

Tenancy, permissions, money, pagination, errors and retries.

MCP server

Let an AI assistant act in a workspace with the user's consent.

Webhooks

Signed deliveries when orders, invoices, quotes or stock change.

The documents your integration moves

1. Quote
2. convertSalesOrder
3. fulfilShipment
4. invoiceInvoice
5. allocatePayment

Choose your integration surface

You are building	Use	Authentication	Start here
A server-to-server connector that reads catalog, customers and document status; creates quotes and orders; or runs a bulk import	Service API	Tenant API key (gm_live_…)	Service API
A staff-facing integration that reads and operates the seller workspace	GraphQL API	ARC user JWT	Authentication and GraphQL
An AI assistant or agent that should act with a user's consent	MCP server	OAuth 2.1 + PKCE	MCP
A receiver that reacts when orders, invoices, quotes or stock change	Outbound webhooks	HMAC-SHA256 signature on each delivery; endpoints managed with an ARC user JWT	Webhooks
A buyer-facing portal or mobile client	Customer/mobile GraphQL operations	Customer auth or the surface-specific public contract	Contact your Growmax account manager before treating admin GraphQL as a storefront API

API keys are not a universal GraphQL credential

gm_live_… keys are accepted by the documented /api/service/* machine-integration routes. They are not a general replacement for the JWT required by most GraphQL resolvers. If you send an API key to a JWT-only GraphQL operation, it will be rejected.

API endpoints

Use the base URL provided by the tenant administrator. ARC does not put a version segment in the URL today. For which host to call, how ARC finds your workspace from it, and why there is no sandbox, see Environments, hosts and test data.

GraphQL:       POST https://<arc-host>/graphql
Service REST:  GET/POST https://<arc-host>/api/service/…
MCP:           POST https://<arc-host>/mcp
Health:        GET  https://<arc-host>/health

What the platform guarantees

• One tenant per credential. The organization is derived from the authenticated credential. Do not send an organization id to select a tenant.
• Server-side business logic. Pricing, tax, inventory, document numbering, status transitions, and permission checks belong to the API.
• Authoritative documents. The normal sales flow is Quote → SalesOrder → Invoice → Payment. Purchasing follows PurchaseOrder → GRN → Invoice → Payment.
• Opaque identifiers. Treat ids, document numbers, cursors, and tokens as opaque strings. Do not construct them or use document numbers as ids.
• Schema-driven GraphQL. The API reference is generated from the same code-first schema that the API boots with.
• Safe retries. Create operations that expose idempotencyKey or accept the Idempotency-Key header should use a stable client-generated key.

A productive build loop

1. Get access

Ask an organization administrator for the tenant API host and the credential appropriate to your integration. API keys are created in Settings → API keys. GraphQL user access requires a real ARC user account and the login mutation; MCP access is granted through the OAuth consent flow.

2. Prove authentication before writing business code

• GraphQL: run the first GraphQL request.
• Service API: run the first service request.
• MCP: connect a client to /mcp and complete OAuth.

3. Read the concepts before creating data

Start with tenancy and permissions, then read errors, pagination, and retries and money, pricing, and tax. Keep the rate and request limits and the error reference open while you build your retry and error handling. These are the contracts that cause most integration failures.

4. Build against the workflow, not the table list

• Catalog and pricing
• Customers and partners
• Quote to cash
• Invoices, payments, and receivables
• Returns, credit notes, and debit notes
• Purchasing and inventory
• Workspace administration and reference data
• Analytics and search
• Service API: reads, quotes, orders, and bulk product import
• Files, document PDFs, and exports

5. Keep the reference open

The reference is exhaustive and intentionally includes admin and surface-specific fields. Use it after a guide has identified the operation you need:

Open the GraphQL API reference →

The reference gives you exact arguments, nullability, enums, deprecations, and return fields. The guides explain when to use an operation and what must happen before and after it.

Production checklist

Before shipping, verify that your integration:

• keeps tokens and API keys on a server, never in browser, mobile, or source control;
• stores the organization context with the integration connection, but never lets a caller override it;
• requests the smallest possible access surface;
• paginates every list and persists the next cursor/offset before the next run;
• retries only retryable failures with exponential backoff and a stable idempotency key;
• treats a GraphQL response with both data and errors as a partial failure that needs explicit handling;
• uses API-returned prices, totals, tax, statuses, and document numbers rather than recalculating them locally;
• logs request ids and operation names without logging credentials or personal data.

Continue with Authentication, or choose a first request.