Skip to main content

​
General

The Integration API is currently in draft specification stage. Production availability is coordinated per pilot customer. Reach out via our contact page for your timeline.
A hosted Prism mock at https://mock.api.novatrade24.com serves stub responses from the spec so you can exercise request/response shape. Full functional staging (https://api.stage.novatrade24.com) opens to pilot customers during onboarding.
No. API calls are rejected with 403 dpa-not-accepted until the DPA is signed and registered on your organization. This is a hard gate.
Not in Phase 1. Generate your own from the OpenAPI spec with openapi-generator-cli in your target language. First-party SDKs (TypeScript, Python, Java) are on the Phase 3 roadmap.

​
Auth and credentials

Yes. Common setup is one client per consuming system (e.g. your DMS plus your accounting tool). Each client has its own credentials but shares the same IntegrationOrganization scope, rate-limit budget, and capability flags.
Contact support to regenerate. Both old and new secrets are valid during a rotation window (typically 24-72h) so you can migrate without downtime.
No. An IntegrationOrganization can have multiple authorized partners; every partner-scoped URL takes the partner UUID in the path. One API client can act on behalf of all authorized partners within its org.

​
Buyers and KYC

Just POST — the API upserts by (sellerId, vatNumber). First call creates; subsequent identical calls return the existing record with 200.
Upgrades A → B are allowed via PATCH. Downgrades B → A are not — iDenfy and AML artifacts are legal records that can’t be retroactively de-scoped.
Generate a self-service invitation (POST /buyers/{id}/kyc/self-service-invitations). The buyer receives an email with a branded upload link. Their submissions flow in the same way as API-uploaded documents — no branching in your code.
No. VIES checks are async workflows; pending/unknown results don’t block other operations. The compliance rollup reports viesResult: PENDING / UNKNOWN until VIES recovers.

​
Orders

Yes. VIN is not unique platform-wide — a vehicle may reappear in multiple orders over time (resale, buyback). GET /orders?vin={vin} returns all matches scoped to your authorized partners.
Most likely: the {sellerId} in the URL path is not in your org’s authorized partners list, or a required capability is not granted. Run GET /v1/me and check.
Cancellation before the VALID / INVALID verdict works via POST /orders/{uuid}/cancel. Post-verdict cancellations are restricted — contact support; the Export File has likely already been produced as a legal artifact.

​
Transport

Use POST /transport/pickup/revoke with a reason. Then re-confirm with the correct data. Revocation is audited.
Multi-VIN orders track per-VIN transport state. Some VINs may be delivered while others are in transit; overall transport status is PARTIAL. Multi-VIN requires the allowMultiVinOrders capability.
Upload a replacement document (same type). Documents are append-only; supersede the bad upload with PATCH setting status: ARCHIVED on the old record. Latest ACTIVE document counts.

​
Webhooks

Root wildcard (*) is not supported — explicit opt-in at least at the segment level (compliance.*, kyc.*). This prevents accidental firehose subscriptions.
Probably not. NT24 retries for up to 72 hours (10 attempts with exponential backoff). If your endpoint comes back in time, events are delivered. For longer outages, the delivery history endpoint lets you replay events within 30 days.
At the per-endpoint level, best-effort — but retries can reorder deliveries. Design handlers to be order-independent and keyed on the resource state (compliance rollup version, etc.), not on event order.
Non-2xx responses are treated as failures. 4xx responses still count against the retry budget — the retries continue on schedule. If you want to signal “don’t retry, I reject this”, return 200 OK and swallow the event silently on your side.

​
Errors and retries

The body changed between retries. Safe retry requires identical key AND identical body. Fresh data = fresh key.
Honor Retry-After plus a small jitter. Don’t busy-loop retries — 10 consecutive 429s from the same API client auto-pauses the client for 15 minutes.
Yes. The server returns Cache-Control hints; we recommend an in-process 5-minute TTL on the org’s partner list and capabilities. Capability changes are rare.

​
Next

Error reference

Full problem-type catalog.

Contact

Ask anything not covered here.