Public API

Programmatic access to the catalog and orders. The key is issued in the client bot; all requests go over HTTPS.

Quick start

1. Get a key from the @nordiinsta_bot — a signing secret is issued with it.
2. Check the key: GET /health must return {"status":"ok"}.
3. Find an item: GET /products?min_qty=10&max_price=1 — you need sku and min_quantity from the response.
4. Top up the key balance: POST /balance/topup, then send the exact amount to the address you get.
5. Order: POST /orders with payment_method "balance" and, if needed, webhook_url. Then poll GET /orders/{id} until the status is completed.

Base URL

https://nordi.site/api/v1

There is no separate api subdomain: any api.* address is not ours — never send your key there.

Authentication

Every request carries the key header:

X-Api-Key: <ваш ключ>

Keys with signing enabled additionally require a timestamp and a body signature:

X-Timestamp: <unix epoch, секунды>
X-Signature: hmac_sha256(secret, f"{ts}\n{body}").hex()

• Clock drift from the server must not exceed 300 seconds.
• The signed string is «timestamp, newline, request body»; for GET the body is empty.
• Replaying the same signature is rejected — anti-replay protection.
• A signature is REQUIRED for POST /orders and POST /balance/topup: a key without a secret cannot make those calls — the answer is 401. Reads (GET) need no signature.

Endpoints

curl -s "https://nordi.site/api/v1/health" -H "X-Api-Key: $KEY"

{"status": "ok", "timestamp": 1786000000}

curl -s "https://nordi.site/api/v1/products?category=autoreg_aged&min_qty=10&page_size=50" \
  -H "X-Api-Key: $KEY"

{"total": 72, "page": 1, "page_size": 50, "items": [
  {"id": 388448, "sku": 732110,
   "title": "Instagram | Авторег API | Отлежка 7+ мес.",
   "category": "autoreg_aged", "price_usdt": 0.3991,
   "quantity": 493, "min_quantity": 10, "is_available": true,
   "has_real_device": false, "followers_count": null, "account_age_days": 255,
   "tags": ["autoreg_aged", "account_2fa"],
   "instant_delivery": true, "instant_stock": 410}
]}

curl -s "https://nordi.site/api/v1/products/732110" -H "X-Api-Key: $KEY"

{"id": 388448, "sku": 732110, "quantity": 493, "min_quantity": 10,
 "price_usdt": 0.3991, "is_available": true, "instant_stock": 410}

curl -s "https://nordi.site/api/v1/instant?max_price=1" -H "X-Api-Key: $KEY"

{"total": 18, "page": 1, "page_size": 50, "items": [
  {"sku": 732110, "instant_delivery": true, "instant_stock": 410, "price_usdt": 0.3991}
]}

curl -s "https://nordi.site/api/v1/categories" -H "X-Api-Key: $KEY"

[{"category": "autoreg_aged", "count": 38, "min_price_usdt": 0.2183},
 {"category": "account_2fa", "count": 20, "min_price_usdt": 0.2903}]

curl -s "https://nordi.site/api/v1/balance" -H "X-Api-Key: $KEY"

{"balance_usdt": 50.0, "total_spent_usdt": 12.5,
 "total_topup_usdt": 62.5, "total_refunded_usdt": 0.0, "currency": "USDT"}

TS=$(date +%s)
BODY='{"amount_usdt":100,"network":"usdt_trc_20"}'
SIG=$(printf "$TS\n$BODY" | openssl dgst -sha256 -hmac "$SECRET" -r | cut -d" " -f1)
curl -s -X POST "https://nordi.site/api/v1/balance/topup" \
  -H "X-Api-Key: $KEY" -H "X-Timestamp: $TS" -H "X-Signature: $SIG" \
  -H "Content-Type: application/json" -d "$BODY"

{"topup_id": "9f1c…", "payment_address": "T…", "payment_network": "usdt_trc_20",
 "amount_usdt": 100.07, "expires_at": 1786003600}

TS=$(date +%s)
BODY='{"product_id":732110,"quantity":10,"payment_method":"balance"}'
SIG=$(printf "$TS\n$BODY" | openssl dgst -sha256 -hmac "$SECRET" -r | cut -d" " -f1)
curl -s -X POST "https://nordi.site/api/v1/orders" \
  -H "X-Api-Key: $KEY" -H "X-Timestamp: $TS" -H "X-Signature: $SIG" \
  -H "Content-Type: application/json" -d "$BODY"

{"order_id": "ND-104512", "status": "processing", "price_usdt": 3.99,
 "quantity": 10, "items": null, "refunded": false,
 "created_at": 1786000000, "updated_at": 1786000000}

curl -s "https://nordi.site/api/v1/orders?status=completed&page_size=20" -H "X-Api-Key: $KEY"

{"total": 4, "page": 1, "page_size": 20, "items": [
  {"order_id": "ND-104512", "status": "completed", "sku": 732110,
   "quantity": 10, "price_usdt": 3.99, "refunded": false}
]}

curl -s "https://nordi.site/api/v1/orders/ND-104512" -H "X-Api-Key: $KEY"

{"order_id": "ND-104512", "status": "completed", "quantity": 10,
 "items": [{"login": "…", "password": "…", "cookies": "…"}],
 "error_message": null, "refunded": false}

curl -s "https://nordi.site/api/v1/usage" -H "X-Api-Key: $KEY"

{"request_count": 1284, "last_used_at": 1786000000,
 "first_used_at": 1785000000, "last_endpoint": "/v1/products",
 "total_spent_usdt": 12.5}

Item fields

sku — the public number; the product page and the order use it too. quantity — stock left; min_quantity — the minimum lot, the backend rejects less; instant_delivery and instant_stock — how many units ship from stock right after the payment; is_available — whether the item is on sale now; tags — the categories it belongs to; title_en and title_zh — the title in other locales, may be empty.

Order statuses

Top-up networks

usdt_trc_20, usdt_bep_20, usdt_polygon, usdt_arbitrum, usdt_ton, usdt_solana. The amount to transfer is reserved as unique — send it to the cent, otherwise the payment has to be found manually.

Rate limits

60 requests per minute per key; the catalog and categories are additionally limited to 120 requests per minute per address. Exceeding it returns 429 with the waiting time in the error text — retry with a delay.

Webhooks

Pass webhook_url in POST /orders — a POST with JSON is sent to it when the order reaches a final state: completed, partial, failed, expired, cancelled or refunded.

POST https://nordi.site/api/v1/orders
{"product_id": 732110, "quantity": 10, "payment_method": "balance",
 "webhook_url": "https://your.site/nordi-hook"}

Body: order_id, status, price_usdt, quantity, product_id, items (the delivery), error_message, refunded, fired_at.

{"order_id": "ND-104512", "status": "completed", "price_usdt": 3.99,
 "quantity": 10, "product_id": 732110,
 "items": [{"login": "…", "password": "…"}],
 "error_message": null, "refunded": false, "fired_at": 1786000000}

• If signing is enabled for the key, the request carries X-Webhook-Timestamp, X-Webhook-Signature (hmac_sha256(secret, "timestamp \n body")) and X-Webhook-Algorithm: HMAC-SHA256.
• Retries: up to 5 attempts with growing delay on 5xx and timeouts; a successful delivery is recorded and not repeated. The URL must be public — local and internal hosts are rejected.
• There are no automatic refunds anywhere, including API orders: if money was charged for an unsuccessful order (failed, expired, cancelled), it does not return to the balance on its own — the refunded field stays false. Contact support with the order number — we will check and refund you manually. The webhook for the final status is sent as usual.

Response codes

Postman collection

A ready collection with every method: put the base URL and the key into environment variables.

Download · postman.json

Getting a key

The key is issued by the shop client bot — @nordiinsta_bot. The secret is shown once and cannot be recovered.