What is the SDS Manager eCommerce API?

The SDS Manager eCommerce API lets your webshop, ERP or back-office system work with your safety data sheets automatically, server-to-server, without anyone logging in through a browser. With it you can download your SDS library together with structured GHS/CLP hazard data, e-mail the correct, up-to-date SDS to a customer, and subscribe or unsubscribe customers from automatic new-version notifications.

It is built for online sellers and distributors of hazardous chemicals who need to show compliant hazard information (EU CLP) and deliver safety data sheets to their buyers reliably and automatically. The API is part of DirectSDS, our SDS distribution for eCommerce and distributors. It uses a single, long-lived API key for authentication and has five endpoints: Library, Library download, Send SDS, Subscribe and Unsubscribe.

Which API endpoints are available?

All endpoints share the same base URL (https://inventory.sdsmanager.com) and are authenticated with your X-Ecommerce-Api-Key header.

A simple way to think about them: the Library endpoints let you read your whole catalogue of safety data sheets, while Send SDS, Subscribe and Unsubscribe let you act for an individual customer. Each endpoint is described further down in this FAQ.

Note: calling the API requires an active eCommerce subscription (eCommerce Premium, Pro or Enterprise). The account owner can generate an API key on Inventory Manager Pro or Enterprise, or on eCommerce Premium, Pro or Enterprise. But an Inventory Manager plan on its own does not enable the endpoints: calls return 401 "No active ecommerce subscription for this API key." until an eCommerce subscription is active.

What do I need before I can use the API?

• An active eCommerce subscription (eCommerce Premium, Pro or Enterprise): this is what enables the API endpoints.
• Account owner access: only the account owner can generate and manage API keys.
• Product identifiers in your library: to send or subscribe by SKU, EAN, UPC or external system ID, those identifiers must be stored on your SDSs. You can add them in bulk with More → Import product list. The internal SDS ID always works, with no setup needed.

What is an API key and why do I need one?

An API key is a unique secret string that identifies your account when your systems call the API. It replaces the browser-style login (JWT tokens), which expires after a short time and is impractical for automated, server-to-server use.

With an API key, your server simply includes the key in every request: no repeated logins, no token refreshing. The key stays valid until you regenerate or revoke it, which makes it the recommended method for any automated integration.

How do I generate my API key?

1. Log in as the account owner.
2. Click More → Settings and scroll to the Integrations section.
3. Click Generate API Key.
4. Copy the key immediately and store it somewhere safe. The full key is shown only once. After you leave the page, it is shown masked (for example abcd1234****wxyz) and cannot be shown again.

If you lose the key, you can generate a new one at any time. Remember that the new key replaces the old one.

How do I authenticate my API requests?

Include your API key in the request header of every call:

X-Ecommerce-Api-Key: YOUR_KEY

The base URL for all endpoints is:

https://inventory.sdsmanager.com

If the header is missing, the key is invalid or the key has been revoked, the API responds with 401 Unauthorized.

How do I regenerate or revoke my API key, and what happens to my integrations?

In the Integrations section of the Settings page you can:

• Regenerate API Key: creates a brand-new key and immediately invalidates the old one. Any request with the old key returns 401 Unauthorized.
• Revoke API Key: deletes the key and stops all API access until you generate a new one.

In both cases, any integration that still uses the previous key stops working. Update every system that uses the key right after you regenerate or revoke it. SDS Manager asks you to confirm before either action.

How do I keep my API key secure?

Treat your API key like a password:

• Never put it in browser or client-side code, on public websites or in shared repositories.
• Store it on the server, for example in a secure environment variable.
• Give access only to the people who really need it.
• If you think it has leaked, regenerate it immediately. This invalidates the exposed key.

Your key authenticates as your account and can only access your own data.

Which product identifier should I use?

Any one of these identifiers is enough to point the API at the right product or SDS:

Use the one your shop or ERP already stores. If you have not set up product identifiers yet, sds_id works out of the box, because every SDS has one.

How do I get my full SDS library?

Call the Library endpoint to get every active SDS in your library, with its structured GHS/CLP data. Archived items, and items without a matched SDS, are not included. This is the best way to fill your webshop's product pages or sync with your ERP.

GET /api/ecommerce/library/

curl -H "X-Ecommerce-Api-Key: YOUR_KEY" \
  "https://inventory.sdsmanager.com/api/ecommerce/library/?updated_after=2025-06-01&page_size=200"

Parameters

Each item includes: id (the id of the item in your library), sds_id, product_name, supplier_name, sds_product_name, sds_supplier_name, sku, ean, upc, external_system_id, revision_date, updated_date, language, slug, public_url (the public page of the SDS), signal_word (code and translated text), ufi_code, ghs_pictograms (code, title and relative image URL), hazard_statements (H-codes with translated text), precautionary_statements (P-codes with translated text), euh_statements (EUH-codes with translated text), ppe_icons (M-codes with title and relative image URL), section_2 (the extracted Section 2 fields), is_hazardous and regulation_check (the ingredients that are on the regulatory lists your account checks, with name, CAS number, concentration and list name).

All hazard texts are returned in the language of the SDS (falling back to English). Image URLs are relative paths: put https://inventory.sdsmanager.com/ in front of them to load the image. Note: product_name and supplier_name are the values of the item in your library, which may differ from the SDS's own sds_product_name and sds_supplier_name.

Example response (one item, shortened):

{
  "id": 987654,
  "sds_id": 123456,
  "product_name": "Example Cleaner",
  "supplier_name": "Example Chemicals AS",
  "sds_product_name": "Example Cleaner 5L",
  "sds_supplier_name": "Example Chemicals AS",
  "sku": "PROD-001",
  "ean": "7012345678901",
  "upc": null,
  "external_system_id": "ERP-555",
  "revision_date": "2025-03-14",
  "updated_date": "2025-03-20T09:15:00Z",
  "language": "no",
  "signal_word": { "code": "D", "text": "Fare" },
  "ufi_code": "U1A2-3B4C-D5E6-F7G8",
  "ghs_pictograms": [
    { "code": "GHS02", "title": "Flammable", "image_url": "media/GHS_pictogram_files/GHS02.png" }
  ],
  "hazard_statements": [
    { "code": "H225", "text": "Meget brannfarlig væske og damp." }
  ],
  "precautionary_statements": [
    { "code": "P210", "text": "Holdes vekk fra varme..." }
  ],
  "euh_statements": [],
  "ppe_icons": [
    { "code": "M002", "title": "Wear eye protection", "image_url": "media/iso_icon_files/m002.png" }
  ],
  "section_2": [],
  ...
}

How do I download my library as a file?

The Library download endpoint gives you the same data as the Library endpoint, as one file. Use file_format=xlsx (the default), csv or json. Excel and CSV are best for spreadsheet tools; JSON keeps the nested lists. updated_after works the same way as on the Library endpoint.

GET /api/ecommerce/library/download/?file_format=xlsx

curl -H "X-Ecommerce-Api-Key: YOUR_KEY" -o sds_library.xlsx \
  "https://inventory.sdsmanager.com/api/ecommerce/library/download/?file_format=xlsx"

For a large library, add lazy=true. The file is then made in the background:

1. The call returns 202 Accepted with a request_id.
2. Call GET /api/ecommerce/library/downloadStatus/?request_id=... until status is done. The response also shows the progress.
3. Get the file from GET /api/ecommerce/library/getDownloadFile/?request_id=.... Do this within 15 minutes, before the file expires.

How do I keep my data in sync without downloading everything each time?

Use the updated_after parameter to get only the items that changed since your last sync:

curl -H "X-Ecommerce-Api-Key: YOUR_KEY" \
  "https://inventory.sdsmanager.com/api/ecommerce/library/?updated_after=2025-06-01"

Run a scheduled job (daily or weekly) that passes the date of your previous sync. It returns only new and updated SDS records, which is much faster and lighter than downloading the whole library every time.

Why does the library hazard data matter for compliance?

Online sellers of hazardous chemicals must show GHS/CLP hazard information for the products they sell. The Library endpoints give you this data in a structured, ready-to-publish form: pictograms, signal words, hazard (H) statements, precautionary (P) statements, EUH statements and UFI codes.

This supports EU CLP Article 48 (in force now), which governs the advertising of hazardous chemicals, as well as the upcoming Article 48a distance-selling requirements that apply from 1 January 2028.

How do I e-mail an SDS to a customer?

Use the Send SDS endpoint. SDS Manager finds the correct, latest SDS by the identifier you give, and e-mails it to the recipient with the PDF attached. You never have to store or send PDFs yourself.

POST /api/ecommerce/messages/send-sds/

curl -X POST -H "X-Ecommerce-Api-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sku":"PROD-001","email":"customer@example.com","add_subscription":true}' \
  "https://inventory.sdsmanager.com/api/ecommerce/messages/send-sds/"

Parameters: email is required, and you must give at least one product identifier.

Duplicate sends are prevented automatically: if every requested SDS was already sent to that recipient, the call returns 400 ("This product has already been sent to the specified email address..."). If only some are new, only the new ones are sent.

How do I subscribe a customer to new-version updates?

Use the Subscribe endpoint to sign up a customer's e-mail address for automatic notifications about a specific SDS. When a new revision is published in your library, the subscribed address automatically receives the updated PDF. This is useful when you want to set up subscriptions without sending the SDS right away, for example when you subscribe existing customers in bulk.

POST /api/ecommerce/subscriptions/subscribe-sds/

curl -X POST -H "X-Ecommerce-Api-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"sku":"PROD-001","email":"customer@example.com","subscription_length_days":730}' \
  "https://inventory.sdsmanager.com/api/ecommerce/subscriptions/subscribe-sds/"

Parameters: email is required, plus at least one product identifier.

If you already used add_subscription: true on the Send SDS endpoint, the subscription was created automatically, and you do not need to call this endpoint as well.

How do I unsubscribe a customer?

Use the Unsubscribe endpoint to remove a customer's e-mail address from new-version notifications. What it does depends on whether you include a product identifier:

• With an identifier (for example email and sku): removes only that subscription.
• Without an identifier (just email): unsubscribes the address from all SDS notifications.

POST /api/ecommerce/subscriptions/unsubscribe-sds/

curl -X POST -H "X-Ecommerce-Api-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"customer@example.com"}' \
  "https://inventory.sdsmanager.com/api/ecommerce/subscriptions/unsubscribe-sds/"

Parameters

Do my existing browser/login (JWT) integrations still work?

Yes, with one limit: the eCommerce endpoints still accept the login-based (JWT) authentication, but the user must be an Owner or Admin (an Admin Light user can also use Subscribe). Other roles get an error 403. A user who is not the owner only gets the SDSs on the locations they have access to. The API key is an additional method, recommended for automated server-to-server use.

Why didn't my SDS e-mail get delivered?

If a Send SDS request does not result in a delivered e-mail, check:

• that the identifier you sent matches a product in your library;
• that the recipient's e-mail address is valid;
• that the SDS PDF service was available. In rare cases a temporary outage can prevent the PDF from being made. Trying again a little later usually solves this.

What do the common error responses mean?

• 401 Unauthorized: the API key is missing, invalid, or has been revoked or regenerated; or the account of the key has no active eCommerce subscription (for example Inventory Manager Pro or Enterprise without an eCommerce plan), which returns "No active ecommerce subscription for this API key." Check the X-Ecommerce-Api-Key header, that the key is current, and that an eCommerce subscription is active.
• 404 Not Found when sending or subscribing: the product identifier did not match any SDS in your library. The response names the field, for example {"detail": "SKU not found: PROD-001"}. Check that the SKU, EAN, UPC or external ID is stored on the right item, or use the sds_id from the Library endpoint.
• 400 Bad Request: a required field is missing or wrong: no e-mail address, no product identifier ("At least one of sds_id, sku, external_system_id, ean, upc is required"), or an invalid e-mail address.