MBNF Stock API

Live, read-only access to the sneaker stock of MBNF SRL for our B2B partners. Plug it into your shop, ERP or spreadsheet and always see what we can ship, size by size.

Quick start#

1. Get your API key

   MBNF sends it to you personally. It looks like mbnf_AbCd1234_… — the first 8 characters after mbnf_ are the key ID (safe to quote to us), the rest is secret.

2. Check that it works

   Call /v1/me: it returns your account name, your limits and when the stock was last updated.

   cURLPythonNode.jsPHP Copy

   curl https://mbnf.supply/api/v1/me \
     -H "Authorization: Bearer $MBNF_API_KEY"

3. Read the stock

   Call /v1/stock and walk through the pages. That's it — see Keeping your stock in sync for a complete, production-ready loop.

   cURLPythonNode.jsPHP Copy

   curl "https://mbnf.supply/api/v1/stock?per_page=200&page=1" \
     -H "Authorization: Bearer $MBNF_API_KEY"

Sandbox#

Want to build before you get your key? Use the public sandbox key: it works on every endpoint and always answers with the same sample products — never our real stock. Responses carry "sandbox": true in meta and the header X-MBNF-Sandbox: true.

mbnf_Sandbox1_public-test-key-sample-data-only

It is limited to 30 requests per minute and 1,000 per day per IP address. When you switch to your own key nothing else changes: same URLs, same fields — only real data.

Try it#

Paste your key — or press Use the sandbox key — and send a real request: you see exactly what your system will receive. The key stays in this page: it is not saved anywhere and disappears when you close the tab. Requests count against your limits like any other.

Authentication#

Send the key in the Authorization header of every request:

Authorization: Bearer mbnf_AbCd1234_your-secret-part

X-API-Key: <key> works too. Keys in the URL (?api_key=, ?token= …) are rejected with 400, because URLs end up in logs and browser history.

A missing, wrong, revoked or expired key always gets the same 401 invalid_api_key — we never say which.

Endpoints#

All endpoints are GET (and HEAD), return JSON and live under https://mbnf.supply/api/v1.

The products we can offer you right now, paginated and ordered by brand and name. Only products with at least one size available are listed.

{
  "data": [
    {
      "sku": "DD1391-100",
      "name": "Nike Dunk Low Retro White Black",
      "brand": "Nike",
      "image_url": "https://image.goat.com/…/DD1391-100.png",
      "price": 145,
      "currency": "EUR",
      "price_vat_included": false,
      "total_quantity": 7,
      "sizes": [
        { "size": "9",  "size_system": "US", "size_eu": "42.5", "quantity": 3 },
        { "size": "10", "size_system": "US", "size_eu": "44",   "quantity": 4 }
      ]
    }
  ],
  "meta": {
    "page": 1, "per_page": 100, "total": 48, "total_pages": 1,
    "stock_updated_at": "2026-10-14T09:12:00+00:00",
    "stale": false
  }
}

One product, same shape as an item of data above, wrapped as {"data": {…}, "meta": {…}}. The SKU is case-insensitive. 404 not_found means it is not available for you right now.

Your key and account. The cheapest way to test a key or check the freshness of the data.

{
  "client": "Your Company B.V.",
  "key_id": "AbCd1234",
  "key_expires": null,
  "prices_included": true,
  "limits": { "requests_per_minute": 60, "requests_per_day": 10000 },
  "usage_today": { "requests": 42, "remaining": 9958 },
  "products": 48,
  "stock_updated_at": "2026-10-14T09:12:00+00:00",
  "stale": false
}

The machine-readable OpenAPI 3.1 specification (no key needed). Import it in Postman, Insomnia or your code generator — or browse it as an interactive reference.

Response fields#

Product

Size

Meta

Keeping your stock in sync#

• Poll every 5–10 minutes. Our data does not change faster than that.
• Send the ETag back. If page 1 answers 304 Not Modified, nothing changed anywhere: stop there. A 304 does not count against your daily quota.
• Read every page, then replace. The feed is the full truth: a SKU or a size that is not in it is sold out — set it to 0 on your side.
• Check meta.stale. If it is true, pause automatic selling.
• Quantities are an offer, not a reservation. Every order is confirmed by MBNF.

import os, time, requests

BASE = "https://mbnf.supply/api/v1"
S = requests.Session()
S.headers["Authorization"] = f"Bearer {os.environ['MBNF_API_KEY']}"
etag = None

def get(params, extra=None):
    while True:
        r = S.get(f"{BASE}/stock", params=params, headers=extra or {}, timeout=20)
        if r.status_code == 429:                       # too fast: wait as told
            time.sleep(int(r.headers.get("Retry-After", "5")))
            continue
        return r

def fetch_all():
    """{sku: product} for everything on offer, or None if nothing changed."""
    global etag
    first = get({"page": 1, "per_page": 200}, {"If-None-Match": etag} if etag else None)
    if first.status_code == 304:
        return None
    first.raise_for_status()
    body = first.json()
    products = body["data"]
    for page in range(2, body["meta"]["total_pages"] + 1):
        r = get({"page": page, "per_page": 200})
        r.raise_for_status()
        products += r.json()["data"]
    etag = first.headers.get("ETag")               # only after a complete read
    if body["meta"]["stale"]:
        print("warning: MBNF stock older than 24h")
    return {p["sku"]: p for p in products}

while True:
    stock = fetch_all()
    if stock is not None:
        update_my_catalog(stock)    # your code: anything NOT in `stock` is sold out
    time.sleep(300)

Rate limits#

Each key has a per-minute allowance (with a small burst) and a daily quota; /v1/me shows yours. Every authenticated response tells you where you stand:

Ten invalid keys from the same IP address within ten minutes block that address for fifteen minutes (429 too_many_failed_attempts), even for valid keys.

Errors#

Errors are JSON with a stable machine-readable error code:

{ "error": "rate_limited", "message": "Too many requests per minute. …", "request_id": "9f2c41d07e3a4b18" }

Security#

• Server-side only. Never put the key in a website, a mobile app or anything that runs on your customers' devices: anyone could read it there. The API intentionally does not support browser CORS requests.
• Store it like a password — in an environment variable or a secret manager, not in your source code.
• Rotation without downtime. You can have two active keys: ask for a new one, deploy it, then tell us to revoke the old one.
• IP allow-list. On request we lock your key to your servers' IP addresses.
• Leaked? Tell us: revocation is immediate.

Versioning#

/v1 is stable. We may add fields and endpoints at any time, so ignore fields you don't know. We will never rename or remove a field, or change its meaning, inside v1: that would be a new version, announced in advance.

Support#

Reply to the message you received your key with, quoting your key ID (the 8 characters after mbnf_) and the request_id of the failing call. Never send us the full key.