Base URL
All API requests are made to:
Authentication
The API uses JWT-based authentication via API keys. You must include the JWT token in your requests.
API Key Login Flow
- Obtain an API key from your Mannco.store account settings
- Call
POST /user/login with your API key to receive a JWT token
- Include the JWT token in subsequent requests (typically via cookies or Authorization header)
JWT tokens expire after 31 days. You’ll need to re-authenticate after expiration.
CSRF protection
All POST requests may require CSRF validation depending on the endpoint configuration.
POST requests accept both application/json and application/x-www-form-urlencoded content types. JSON payloads are automatically decoded.
Permission levels
Endpoints require specific permission levels:
| Permission | Description |
|---|
| Public | No authentication required |
| API | Valid JWT token required (obtained via API key login) |
| Connected | User must be authenticated |
| 2FA | User must have validated 2FA for the current session |
| Admin | User must have admin privileges |
{userid} path parameter to operate on behalf of another user.
All API responses return JSON with a standardized structure:
Success responses
{
"err": false,
"success": true,
"content": {
/* Response data here */
}
}
Error responses
{
"err": true,
"success": false,
"content": "Error message description"
}
Response fields
| Field | Type | Description |
|---|
err | boolean | false for success, true for errors |
success | boolean | true for success, false for errors |
content | object/string | Response data (object) for success, error message (string) for errors |
Error codes
| HTTP Code | Response Type | Description |
|---|
200 | Success | Request completed successfully |
300 | Error | General error (business logic error) |
403 | Forbidden/Unauthorized | Insufficient permissions, invalid CSRF, or invalid API key |
404 | Not Found | Endpoint or resource not found |
500 | Server Error | Internal server error |
Specific error responses
| Status | Message |
|---|
error | Missing required parameter: apiKey |
forbidden | Invalid API key |
forbidden | Country blocked |
$1.50 is represented as 150.
Common types
SteamID
User identifiers are Steam 64-bit IDs (e.g., 76561198000000000), passed as strings.
Game IDs
| Game | ID |
|---|
| Team Fortress 2 | 440 |
| Counter-Strike 2 | 730 |
| Dota 2 | 570 |
| Rust | 252490 |
Item states (backpack)
| State | Description |
|---|
0 | In user inventory (not listed) |
1 | Listed for sale |
2 | Pending withdrawal |
3 | In active trade |
| Negative | Reserved for giveaway |
Offer statuses
| Status | Description |
|---|
0 | Active / Pending |
1 | Accepted |
2 | Declined |
3 | Removed / Cancelled |
-1 | Auto-cancelled: buyer insufficient balance |
-2 | Auto-cancelled: offer expired |
-3 | Auto-cancelled: item no longer available |
Trade statuses
| Status | Description |
|---|
0 | Pending |
3 | Completed |
-1 | Failed |
-11 | Hidden |
-12 | Reverted (admin) |
