Your business.
Connected.

Authentication and environments

Use a separate key for each integration and grant only the required scopes. Business keys are distinct from messaging keys. A secret is displayed once; store it in your server environment. Revoke it in Developer settings if exposed.

Authorization: Bearer vanu_biz_test_YOUR_KEY
Content-Type: application/json
Idempotency-Key: unique-request-001

Sandbox keys start with vanu_biz_test_; live keys start with vanu_biz_live_. Sandbox requests store isolated test records and cannot send messages, reserve real slots, change real stock or collect payments. Sandbox translations return a labelled demo sentence rather than calling an AI provider.

Base URL: https://zqxcrvjsnunjuelmrydm.supabase.co/functions/v1/business-api/v1. API version v1 is part of the URL. Every response identifies livemode.

Endpoint reference

Start with sandbox

First create a test key with commerce:read. This request only reads a demo product.

curl "https://zqxcrvjsnunjuelmrydm.supabase.co/functions/v1/business-api/v1/products" \
  -H "Authorization: Bearer $VANUCONNECT_BUSINESS_KEY"

Live resource lists return up to 100 records, ordered by ID. If has_more is true, repeat the request with ?after=NEXT_CURSOR. Use the returned next_cursor. Slots and the sandbox demo catalogue are not paginated.

Create resources safely

Resource creation requires an Idempotency-Key of 8–100 characters. Reuse exactly the same key and JSON when retrying; a changed payload returns 409. Keep a unique key for every distinct operation. Translations are a text-only request and do not accept resource idempotency keys.

All public money fields ending in _minor are integers: VUV 1 = one vatu; AUD 100 = A$1.00. Invoice tax and discount are explicit reviewed amounts. Invoice quantities and order quantities must be whole positive numbers. Supported currencies: VUV, AUD, NZD, USD, FJD, EUR and GBP. Legacy source money with unsupported precision returns null amounts and money_needs_review=true; correct the source before proceeding.

{
  "name": "Example customer",
  "phone_number": "+6785550101",
  "email": "customer@example.com"
}

{
  "client_name": "Example company",
  "currency": "VUV",
  "issue_date": "2026-11-02",
  "due_date": "2026-11-16",
  "items": [
    {
      "description": "Consulting",
      "quantity": 2,
      "unit_price_minor": 5000
    }
  ],
  "tax_minor": 1500,
  "discount_minor": 0
}

{
  "service_id": "00000000-0000-4000-8000-000000000002",
  "date": "2026-11-02",
  "time": "10:00",
  "customer_name": "Example customer",
  "customer_phone": "+6785550101"
}

{
  "customer_name": "Example customer",
  "currency": "VUV",
  "items": [
    {
      "product_id": "00000000-0000-4000-8000-000000000001",
      "quantity": 2
    }
  ]
}

{
  "source": "en",
  "target": "bi",
  "text": "Good morning. Welcome to VanuConnect."
}

An order is a pending, unpaid request and does not reserve stock; confirm it in VanuConnect after checking availability. Invoice drafts are not automatically sent or charged. The returned live payment_url opens the existing customer invoice page; available payment methods depend on the business configuration.

Gold Bislama

Translation uses the approved Storian Bislama glossary, grammar and example pairs as language grounding. It preserves numeric details and returns an error if that validation fails. Have important customer-facing, financial or official translations reviewed by a fluent speaker. The initial API supports English to Bislama; French and reverse translation are outside this contract. Sandbox returns a labelled demo. Live translation needs operator enablement and an active AI model configuration for your business.

Signed events and retries

Register an operator-approved HTTPS hostname in Developer settings, choose sandbox or live, and subscribe to contacts.created/updated, bookings.created/updated, invoices.created/updated or orders.created/updated. Save the signing secret shown once.

VanuConnect-Event-Id: EVENT_UUID
VanuConnect-Signature: t=UNIX_SECONDS,v1=HEX_HMAC_SHA256

signed_payload = timestamp + "." + event_id + "." + raw_request_body

Compute HMAC-SHA256 with your signing secret and compare signatures in constant time. Accept timestamps only within five minutes, deduplicate the event ID, persist the event and return 2xx promptly. Events contain IDs and status; fetch customer details separately with an authorised key. Test events contain livemode: false.

The dispatcher makes up to eight automatic attempts, beginning at 30 seconds and doubling the delay, with the same event ID and a fresh timestamp. Delivery is at least once. Inspect delivery history and manually retry a failed event after fixing your endpoint. Only approved IPv4 HTTPS hosts are supported initially; redirects, URL credentials, private addresses and IPv6-only destinations are rejected. Host approval and the dispatcher schedule require administrator setup.

Limits and errors

Per key: 60 requests/minute, 5,000/day. Translation pilot: 10 requests/day, up to 2,000 characters each. Request JSON is limited to 64 KB. Limits are enforced atomically. A 429 includes Retry-After; for the daily limit, retry on the next UTC day.