Skip to main content

​
Base URL

All documented requests use:

​
Authentication

Programmatic access uses a JWT from your API key (created in your Mannco.store account). See Authentication for POST /user/login and the Authorization header.
  • Routes with connected + api: send Authorization: Bearer <jwt> unless noted otherwise.
  • GET /user/store/{identifier} only requires the api route filter — no logged-in user.
  • JWT lifetime is about 31 days; the payload includes API: true and a bound client IP (see Authentication).

​
Two-factor authentication (2FA)

Routes that include the server-side 2fa filter do not require a 2FA code when you use a JWT obtained from POST /user/login (API flow). The browser session flow may still prompt for 2FA.

​
CSRF

For routes that include the api filter, POST requests from API clients do not need the browser CSRF token. JSON bodies are supported (Content-Type: application/json); the router merges JSON into POST parameters.

​
Rate limiting

When the JWT has API: true, the API may enforce per-user, per-route, per-method limits. When exceeded:
  • HTTP 429
  • Headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After
  • JSON body: content is a short message (retry after N seconds)
Typical defaults (subject to per-user or per-endpoint overrides) are on the order of 600 requests per 60-second window for GET and POST. Exact numbers may change without a docs update.

​
Scope

Only routes whose definition includes the api filter are documented here, plus POST /user/login (API key exchange — required for authenticated calls). Website-only flows (browser session, cashout routes without api, etc.) are out of scope for these pages.

​
Endpoints by area

Every documented endpoint lives in the navigation tabs above, each with an interactive playground and code samples:
  • Buyer — Items, Offers, Buy Orders, Payment, Inventory, and Cart.
  • Seller — Listing (deposit and instant sell).
  • Trading — active trades, trade history, and resends.
  • User Account — profile, balance, sessions, and history.
Admin-only variants (extra {userid} path segments) are not detailed here.

​
Response format

All JSON responses share this shape.

​
Success

Payload data is always under content.

​
Business error (Response("error", …))

Often HTTP 300 with:
content may be a string or an object depending on the endpoint.

​
Common HTTP status codes

​
Prices

Monetary amounts are integer cents (e.g. 150 = $1.50 where applicable).

​
Common types

​
SteamID

64-bit Steam ID as a string, e.g. 76561198000000000.

​
Game IDs

​
Backpack / listing states

​
Offer statuses

​
Trade statuses