Developers

LARM Developers

Build apps that run inside LARM stores

A REST API for every store, OAuth 2.0 with PKCE, and signed webhooks that reach your server for every order, payment and delivery. This is the complete reference, from your first request to publishing your app to merchants.

QuickstartAPI reference
llms.txt
Base URL
https://larm.sa/stores/{storeId}/v1
Auth
OAuth 2.0 + PKCE
Version
2026-10-15
Webhook deliveriesPOST app.example.com/larm/webhooks

x-larm-eventorder.status.updatedx-larm-signaturev1=5d41…d5e6

Body
{
  "type": "order.status.updated",
  "resource": {
    "type": "order",
    "id": "ord_8Kd2",
    "version": 4
  },
  "data": {
    "id": "ord_8Kd2",
    "number": 10482,
    "status": "completed",
    "previous_status": "processing"
  }
}
Every event and its payload

How it fits together

One install, one token, one stream of events

Your app server calls the LARM API with an access token and receives signed webhooks; the merchant's store installs the app and grants scopes through LARM. Your appYour server, any languageKeeps tokens server-sideVerifies signaturesLARMAPI · OAuth · webhooksEnforces scopesSigns every eventMerchant's storeDashboard, storefrontApproves scopesOrders, products, stock REST + Bearer tokenSigned webhooks Install + scopesStore data client_id + secret/stores/{storeId}/v1order.paid
  1. InstallThe merchant installs your app and approves its scopes. Your server exchanges the authorization code for tokens. OAuth 2.0
  2. Call the APIRead and update the store with the access token: orders, products, inventory, pages. API reference
  3. React to eventsLARM signs and delivers webhooks the moment something happens in the store. Webhooks

From zero to your first request

  1. Create your account and organization in the Developer Portal, then create an app draft with a launch URL and a redirect URL.
  2. Install the app on a development store. The merchant approves the scopes, and your server receives an authorization code.
  3. Exchange the code for an access token at the token endpoint, then call List orders.
  4. Subscribe to order webhooks to receive every new order, payment and digital delivery as it happens.
  5. Submit the version for app review. Once approved, your app appears in the LARM App Store.
Request
curl "https://larm.sa/stores/$STORE_ID/v1/orders?payment_status=paid&limit=1" \
  -H "Authorization: Bearer $ACCESS_TOKEN"
Response 200
{
  "data": [
    {
      "id": "ord_8Kd2",
      "number": 10482,
      "status": "processing",
      "payment_status": "paid",
      "currency": "SAR",
      "totals": {
        "subtotal": "180.00",
        "discount": "0.00",
        "shipping": "25.00",
        "total": "205.00"
      },
      "items": [
        {
          "product_id": "311",
          "name": "Top-up card 100 SAR",
          "kind": "digital",
          "quantity": 2,
          "unit_price": "90.00",
          "total": "180.00"
        }
      ],
      "order_url": "https://store.example/orders",
      "created_at": "2026-10-15T09:12:44Z",
      "updated_at": "2026-10-15T09:13:01Z",
      "paid_at": "2026-10-15T09:13:01Z",
      "refunded_at": null,
      "customer": {
        "id": "c_2041",
        "name": "Sara Alotaibi",
        "phone": "+966512345678",
        "email": "[email protected]"
      },
      "shipping_address": null,
      "resource_version": 0
    }
  ],
  "execution": {
    "appId": "1f2e3d4c-5b6a-4978-8695-a4b3c2d1e0f9",
    "versionId": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
    "installationId": "c7e4a1f2-6b3d-4e8a-9c05-1d2f3a4b5c6d",
    "storeId": "5b1d7a62-0c4e-4f38-9a51-2e7b3c9d8f10",
    "requestId": "3f0c2b8e-7a51-4c1e-9d0a-5b6f1e2d4c3a",
    "generation": 1,
    "routeEpoch": 4,
    "appAuthEpoch": 1,
    "grantRevision": 2
  },
  "meta": {
    "next_cursor": "eyJ…",
    "request_id": "3f0c2b8e-7a51-4c1e-9d0a-5b6f1e2d4c3a"
  }
}

Explore

QuickstartFrom creating the app to your first successful call.OAuth 2.0 with PKCEAuthorization with PKCE, tokens and refresh token rotation.App launchThe larm_* parameters and launch URL verification.API fundamentalsResponse envelope, cursor pagination, ETags, idempotency keys and limits.WebhooksSubscriptions, signatures, retries and delivery.App uninstall & data deletionInstallation webhooks, scope revocation and data-deletion requests.ScopesEvery scope and the fields, endpoints and webhooks it unlocks.OrdersThe full order: items, amounts, payment status and the customer order link.Webhook eventsorder.created, order.paid, digital delivery and abandoned carts.Error codesEvery code and what your app should do about it.

    ↑↓ moveEnter openEsc close