Your deployment is the contract
There is no shared Box API gateway. Fetch the OpenAPI document from the engine you are integrating with because its routes reflect the packages actually installed there.
curl $BOX_HOST/openapi.json -o openapi.json
box codegen --lang ts --from openapi.json
npm install @box/clientRequest and response
curl $BOX_HOST/orders/ord_7Q2 \
-H "Authorization: Bearer $BOX_TOKEN"{
"id": "ord_7Q2",
"merchant": "mch_41",
"channel": "counter",
"status": "paid",
"total": 537500,
"currency": "NGN",
"payment": { "id": "pay_5K1", "method": "card" }
}Orders, customers, payments, and settlement retain the same identifiers across websites, counters, links, and institution-built surfaces.
SDKs for specialised surfaces
Generated clients cover the engine contract. The retail SDK adds device pairing, hardware-backed keys, local catalogue state, and an offline queue for tills.
implementation("shop.box:arr-core:2026.9")
implementation("shop.box:arr-compose:2026.9") // optional UIimport { Box } from "@box/client"
const box = new Box({ host, token })
const order = await box.orders.get("ord_7Q2")Signed events instead of polling
box webhooks add \
--url https://ops.yourbank.example/box \
--event order.paid{
"event": "order.paid",
"merchant": "mch_41",
"order": "ord_7Q2"
}Payloads carry identifiers rather than stale copies of records. Verify the delivery signature, then fetch the current record from your own engine.
Bind providers at explicit ports
box ports bind payment --adapter your-acquirerPayments, delivery, messaging, tax, and banking integrations implement contracts owned by the deployment. Your institution keeps the provider relationship and credentials.

