Publish your stock on your website

Car dealershipsOnly in car-dealership workspaces.

A dealership's website has to show the lot, and the lot changes every day. This recipe does it with one read-only credential and three endpoints. There's nothing to synchronise and no copy that goes stale.

You end up with a page that lists the published cars, filters them by location and opens one of them.

1. A key that can only read the lot

Mint it with the narrowest permission there is, stock:read, from a key that already holds it (Authentication):

curl -X POST https://api.vitrinadev.com/api/v1/api-keys \
  -H "Authorization: Bearer $VITRINA_ROOT_KEY" \
  -H "Content-Type: application/json" \
  -d '{ "name": "sitio web del lote público", "scopes": ["stock:read"] }'

A key's name is a free-form label, and the examples on this site write theirs in Spanish. The API stores whatever you send.

Trap

This key lives on your server, never in the browser

stock:read is read-only, but it's a credential of the workspace: whoever holds it can read the whole lot, as many times as they like, until somebody revokes it. Put it in the page's JavaScript and anyone who opens the inspector has it. Call the API from your server, whether that's a function, an endpoint of your own or the site's render, and send the browser the result instead of the key.

2. How many there are

GET /stock/count is the cheapest call in the API. It tells you whether there's anything to show before you build the page:

curl https://api.vitrinadev.com/api/v1/stock/count \
  -H "Authorization: Bearer $VITRINA_KEY"

{ "data": { "count": 7 } }

It takes the same filters as the list, so it is also the counter behind "7 SUVs available" without fetching all seven.

3. The list

curl "https://api.vitrinadev.com/api/v1/stock?limit=2" \
  -H "Authorization: Bearer $VITRINA_KEY"

{
  "data": [
    {
      "id": "5d00f5cf-ebe3-4e8b-a456-8d783daed0be",
      "make": "Suzuki",
      "model": "Swift",
      "version": "GL 1.2",
      "year": 2021,
      "price": { "amount": 9490000, "currency": "CLP" },
      "odometer": { "value": 31400, "unit": "KM" },
      "type": "Car",
      "type_label": "Auto",
      "listing_type": "Usado",
      "status": "disponible",
      "reserved_at": null,
      "sold_at": null,
      "sucursal": {
        "id": "6812d9f0-9bed-44b5-91df-4e5b90941f6b",
        "name": "Sucursal Providencia",
        "comuna_code": "13123",
        "comuna_name": "Providencia",
        "region_code": "13"
      },
      "photos": [],
      "created_at": "2026-09-22T00:30:01.896Z",
      "published_at": null
    }
  ],
  "meta": { "pagination": { "limit": 2, "offset": 0 } }
}

Three things that decide how you write the page's code:

It pages by offset and never by cursor, twenty units at a time by default. To build a full grid, raise limit or walk it with offset until data comes back empty.
It arrives ordered by creation date, descending. The first thing you see is the last thing the dealership loaded, usually what you want at the top.
price.amount comes in whole pesos and odometer with its unit spelled out. You divide nothing and you guess nothing. If the unit had its odometer in miles, the conversion is already done.

The sucursal block comes embedded in every unit, with the comuna already resolved to a name. You don't have to cross-reference Locations to write "Providencia" under the photo.

4. The filter you will actually use

curl "https://api.vitrinadev.com/api/v1/stock?sucursal=6812d9f0-9bed-44b5-91df-4e5b90941f6b" \
  -H "Authorization: Bearer $VITRINA_KEY"

?sucursal= takes the id that comes in the embedded block. For the page's selector, list the locations once with GET /locations and keep them around: they change once a year. The lot itself you read on every load.

The other filters are in Stock with their exact values: make, model, year, price and type.

5. One unit

curl https://api.vitrinadev.com/api/v1/stock/5d00f5cf-ebe3-4e8b-a456-8d783daed0be \
  -H "Authorization: Bearer $VITRINA_KEY"

It returns the same object the list carries. There's no "expanded" version: a field that isn't in the list isn't here either. You can render the detail page from what the grid already gave you, and call the detail only to refresh it.

6. What you will never receive, and why that matters

The public lot is a projection of the inventory. It doesn't carry the patente, the VIN, the cost, the margin or the internal notes. Nor the cars the dealership is holding unpublished. That lives behind another permission and another endpoint (Authentication).

That's why this recipe is safe to put on a website. Even if the key leaked, what leaked is what the dealership is already showing in its showroom window.

Every filter, the ordering and the statuses are in Stock. The website's other half, what happens when somebody asks, is in Receive leads in your CRM.