inceleDocumentationDevelopersWebsite ↗Open dashboard ↗

INCELE DOCUMENTATION

↗ Read as Markdown✧ Agent-readable docs

Build your own website or application

Use İncele as your catalogue and website configuration backend while hosting your own frontend, mobile application, or business system. You control presentation; İncele controls workspace ownership, validation, media and AI credit accounting.

Website / mobile app → Your authenticated backend → İncele External API
                                                 → Workspace products / media / configuration

Keep the account API key on your backend. A mobile bundle or browser environment variable is public and cannot protect a secret. Authenticate your own customers, authorize each request, and return only the fields your frontend needs. An API key acts for its issuing account, not for a customer visiting your website.

Capability map

Capability External API contract Permission
Account profile /v1/account account:read, account:write
List and create owned workspaces /v1/workspaces workspaces:read, workspaces:write
Workspace business information See workspace operations in Swagger workspace:read, workspace:write
Catalogue and inventory Workspace /products products:read, products:write
Collections and membership Workspace /collections and membership operations collections:read, collections:write
Tags and assignments Workspace /tags and assignment operations tags:read, tags:write
Images Workspace /media, /media/upload media:read, media:write
Templates and editable website configuration Workspace website operations website:read, website:write

Use the exact paths and scopes in Swagger and the generated reference; that registry is the contract. A workspace path always begins /v1/workspaces/{workspaceId}. Account keys can address multiple currently owned workspaces. Workspace creation still follows the account's current creation limit.

Catalogue synchronisation

  1. List owned workspaces and select the intended workspace explicitly.
  2. Page through products; store the returned İncele IDs alongside your own IDs.
  3. Upload supported raster images and use their media IDs in product writes.
  4. Read the current product before updating its complete editable fields.
  5. Update collection memberships and tag assignments using their dedicated operations.
  6. Publish only reviewed, active products in your frontend. Management lists include drafts/inactive products and must not be forwarded unfiltered.

Keep SKU and barcode stable. After an uncertain write response, fetch and reconcile before retrying. There is no general create-product idempotency header or guaranteed webhook/event delivery contract. Use polling with a bounded interval and backoff; avoid re-importing the entire catalogue on every customer visit.

Website configuration

Read the workspace template schema and current configuration before writing. Use only schema-supported fields. A custom frontend can render those values independently; selecting a hosted template does not provision or deploy your own application. Do not treat website text, sales links, imported descriptions or agent output as trusted HTML. Escape content and allow only appropriate URL protocols.

AI and customer-facing features

Use the Customer experience API under /v1/workspaces/{workspaceId}/experience for published catalogue browsing, customer email sign-in, profile, product/routine AI chat, face analysis, feedback and analytics. These authenticated endpoints reuse the hosted site's visitor identity, Turnstile, quota and workspace credit accounting. Your account key stays on your backend; a separate visitor credential identifies each customer.

Account/Administration controls and platform credit checkout are not customer capabilities. Customer sessions cannot manage accounts, API keys or workspaces. Never proxy internal routes or substitute an owner session for a visitor. Use only the external paths listed in Swagger.

Go-live checklist

  • Use production keys only against https://api.incele.ai; XYZ credentials and data are separate.
  • Request only required scopes and set key expiry/rotation reminders.
  • Restrict your backend's public routes and never build an unrestricted proxy to /v1.
  • Validate inputs, escape outputs, enforce your own customer permissions and limit requests.
  • Handle pagination, conflicts, revoked credentials and rate limits explicitly.
  • Redact Authorization headers, private customer data and secret values from logs.
  • Check the current API contract before adopting an operation.