REST API

Everything lives under the WordPress REST namespace smb2b/v1.

Base URL: https://your-store.com/wp-json/smb2b/v1

Authentication

There is no bespoke key system. The API uses WordPress’s own authentication:

• Application passwords (recommended) — create one under Users → Profile → Application Passwords, then use HTTP Basic auth: Authorization: Basic base64(username:app_password).
• Cookie + nonce — for same-origin admin requests, send the X-WP-Nonce header.

Admin endpoints require manage_woocommerce (a few require manage_options). Buyer endpoints require a logged-in customer and are scoped to the caller.

Resolve a price

The headline endpoint. It runs the full pricing pipeline — groups, company, quantity bands, rules — for any product, customer and quantity.

GET /price?product_id=123&user_id=45&qty=10

Parameter	Required	Notes
product_id	yes	Product or variation id
user_id	no	Customer to price for; omit for retail/guest
qty	no	Quantity, default 1 — applies quantity bands
variation_id	no	For variable products

{
  "success": true,
  "data": {
    "price": 42.50,
    "base_price": 50.00,
    "source": "group_product",
    "is_discounted": true,
    "trail": [{ "level": "group_global", "outcome": "applied", "detail": "…" }]
  }
}

This is the same data the admin “Check a price” screen shows, from the same resolution — so an ERP quoting from this endpoint quotes exactly what checkout will charge.

Read endpoints

Resource	Endpoint
Customer groups	GET /groups, GET /groups/{id}
Price rules	GET /rules
B2B registrations	GET /registrations
Companies (Pro)	GET /companies, GET /companies/{id}
Company members (Pro)	GET /companies/{id}/members
Quotes (Pro)	GET /quotes, GET /quotes/{id}
Credit accounts (Pro)	GET /credit, GET /credit/{companyId}

Write endpoints (POST/PUT/DELETE) exist on the same routes and back the admin app.

Webhooks (Pro)

Rather than polling, subscribe to events and receive a signed POST. Manage subscriptions under Settings → API & Webhooks.

Event	Fires when
registration.pending	a B2B registration is submitted for approval
quote.submitted	a buyer submits a quote request
order.awaiting_approval	an order is held by the spend-limit approval chain
invoice.overdue	a net-terms invoice passes its due date

Deliveries are a JSON POST:

{
  "event": "quote.submitted",
  "created_at": "2026-07-20T10:15:00+00:00",
  "data": { "quote_id": 42 }
}

with headers X-SMB2B-Event and X-SMB2B-Signature: sha256=<hmac> — an HMAC-SHA256 of the raw body using the subscription’s signing secret, which is shown once when you create it.

Verifying a delivery

$payload   = file_get_contents('php://input');
$expected  = 'sha256=' . hash_hmac('sha256', $payload, $your_secret);
$signature = $_SERVER['HTTP_X_SMB2B_SIGNATURE'] ?? '';

if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit;
}

Deliveries are sent asynchronously through Action Scheduler, so a slow receiver never holds up a checkout or a registration. Recent delivery results are listed on the Webhooks screen.

Notes

• All money values are in the store’s base currency.
• Timestamps are ISO 8601 UTC.
• Order data is read through the WooCommerce CRUD, so the API is HPOS-safe.

If you are integrating a plugin on the same site — a CRM, for example — you usually want the action hooks rather than webhooks.