One account, one token, the whole purchase
Every call runs against your own COLAMCO account — your catalog, your pricing, your orders. There is no separate data feed to reconcile and no batch window to wait for.
- Products and live stock Detailed product information, and quantity available with the date it was last confirmed with the vendor — per product and per catalog.
- Your pricing, not a list price Prices come back for the account making the call. Negotiated and quoted prices stay negotiated — a quoted line is never silently re-priced.
- Place orders Prepare an order, review what we priced it at, then process it. The price you send is the price we honour.
- Shipments and serial numbers Order status, shipment detail, tracking, and the serial numbers of what actually shipped — read them back per order or in a report.
- Reporting Business tracking, ordered and shipped items, ASN and shipping-method reports — the same numbers your account manager sees.
- Asset lifecycle Recycle requests, credits, certificates of destruction and lifecycle summaries, for the equipment you are retiring as well as the equipment you are buying.
REST, over XML or JSON
Ask for the format you already speak and we answer in it — no translation layer, no
fixed-width file, no SFTP drop. A bearer token from your account authorises the call, and
IsTest: true keeps it out of live order and payment flows while you build.
curl -X GET "https://services.colamco.com/Integration/v1/Products/2846426" \ -H "Authorization: Bearer {{token}}" \ -H "IsTest: true" \ -H "Accept: application/json"
{
"ProductID": 2846426,
"CoPartNo": "CO-2846426",
"MfgPartNo": "24F9-B2",
"ProductName": "24\" LED Monitor, 1920 x 1080",
"QuantityAvailable": 142,
"QuantityDate": "2026-08-18T18:40:11Z",
"Price": 189.42,
"MSRP": 249.99
}
Generated from the running service
It cannot drift from what the API accepts
The reference is built from the live API specification, so every parameter, response code and schema on the page is the one the service is enforcing right now. Operations are grouped by area and searchable from anywhere with Ctrl K.
Each one carries copyable code samples in curl, C#, PowerShell and JavaScript, and the full OpenAPI JSON and a generated Postman collection are one click away.
Test any endpoint while you are reading about it
Every operation has a console built into it. A token is issued automatically from your sign-in, so there is nothing to paste. Fill in the parameters, send the call, and read the real response with its status code, timing and size.
Test mode is on by default — the request carries IsTest: true
and stays out of live order and payment flows. Every call is kept in a per-tab history
so you can compare attempts.
Two flows that need no code at all
If your procurement platform already speaks cXML or xCBL, you do not have to write against the REST API to buy from us. Both flows are documented the same way the endpoints are: what the exchange looks like, what we verify, and what every response code we return means.
cXML PunchOut
Your buyer stays inside your procurement system, shops our catalog in a session we open for them, and their cart is handed straight back to you for approval — so the requisition, the approval chain and the audit trail all stay yours.
Your credentials are authenticated on the way in, not merely echoed, and the catalog a session opens is verified against them.
xCBL orders through Exostar
Send an xCBL OrderRequest and read the OrderResponse. Every
rejection code we can return is documented with what it means and how to resolve it, so
a rejected order is a fix rather than a phone call.
Test documents are recognised as tests end to end: they are recorded, and they never reach a live order flow.
What your integration did, in your own words
Every call, logged and searchable by you
Every transaction your account makes is recorded with the full request and response behind it, and you search it — by status, endpoint, date or transaction ID, or by dragging across the volume chart to zoom into a time range.
Each API response carries a TransactionID header pointing straight at its
entry, so quoting that value lets us see exactly what your request did. Sensitive values
are removed before anything is written.
A home page that opens on your own traffic
How many requests your account made in the last 24 hours, hourly traffic, your error rate, and your most recent calls with the time each one took. A short quick start sits on the same page for anyone integrating for the first time, and every step links into the matching documentation.
Locked to you, on both ends
- Your account can be restricted to the IP addresses you call us from, so a leaked token off your network is not enough.
- Strong TLS on every endpoint, and bearer tokens that expire rather than sit in a config file forever.
- Sign-in to the console supports an emailed verification code, an authenticator app, or a passkey — your device's fingerprint, face or PIN in place of a password.
- Sensitive values are redacted before the log is written, so your own request log can be shared internally without leaking a credential.
- PunchOut credentials are authenticated, compared in constant time, and a refusal tells the caller nothing about which catalogs exist.
On a phone, and in the dark
The console is responsive down to a phone screen, and it has a light and a dark theme that follow your device preference or your own choice.
Four steps to a confirmed test order
- Request an account Tell us who you are and what you need to connect. A person reads every request — there is no self-service sign-up.
- Get your credentials We provision the account your integration needs, with the right catalog and pricing behind it, and email you when it is ready.
- Make your first calls Authenticate, read a product, and send a call from the console while you read the operation — in test mode, against the sandbox.
- Place a test order, then go live Prepare and process a test order, check it in your own request log, and turn test mode off when you are ready.
Start integrating with COLAMCO.
Tell us what you need to connect and we will set your account up. If you already have one, your documentation, sandbox and request log are behind the same sign-in.