Skip to main content

Custom REST API

If your store isn't on Shopify or Salesforce Commerce Cloud, you integrate Pinch via direct REST calls. The same decisions, scores, and dashboard surface — you just send events from your own service instead of relying on a turnkey app.

When to use this path​

  • You're on Magento, WooCommerce, BigCommerce, commercetools, Spree, or another platform Pinch doesn't have a turnkey app for.
  • You run a headless commerce stack with a custom storefront.
  • You want to integrate Pinch into a non-storefront flow — for example, account-creation scoring in a mobile app.
  • You're a partner or RMS building Pinch into your own product.

What you'll need to send​

EventEndpointWhen to call
Signup (optional)POST /v1/evaluate/signupWhen a customer creates an account
Login (optional)POST /v1/evaluate/loginOn every login attempt, success and failure
Order (required)POST /v1/orderWhen a customer checks out
Return (required)POST /v1/returnWhen a customer initiates a return
Disposition (required)POST /v1/return/disposition/{return-id}When your warehouse inspects the returned item
Dispute (recommended)POST /v1/order/dispute/{order-id}When a chargeback opens or resolves
Account update (optional)POST /v1/evaluate/accountOn sensitive changes — password, email, payout

Order, Return, and Disposition are the minimum. The rest improve detection accuracy.

Quickstart​

The fastest path to a working integration:

  1. Email support@pinch.ai for sandbox API keys.
  2. Walk through the REST API Quickstart — send your first Order and Return.
  3. Drop the Device JS SDK onto your storefront to capture visitorId for device fingerprinting.
  4. Wire up disposition data, either via API or via the dashboard CSV upload.
  5. Move to production keys when your sandbox traffic matches expectations.

Full reference, including request/response shapes, errors, and idempotency rules: API reference.

What's the same as Shopify and SFCC​

  • The Pinch team still configures your workflows, decisions, and variables during onboarding.
  • Decisions still come back as ALLOW / DENY / REVIEW plus a 0–100 abuse score.
  • The dashboard surface (Review queue, Customers, Analytics) is identical.

What's different​

  • You're responsible for calling each endpoint from your service. There's no install button.
  • Decisions are returned in the API response (and via webhook — coming soon) rather than written as customer tags on a platform you don't control.
  • You enforce decisions in your own application code — for example, blocking a refund flow when Pinch returns DENY.

See also​