Code examples

Working requests in Shell, JavaScript and Python: list with a filter, create, update with an ETag, run a function, and page through results.

Last updated September 17, 2026

On this page

Replace <your app address> with the address on your API tab and pxa_sk_... with a secret key. Keep secret keys on a server.

List open orders

Shell

curl -G https://<your app address>/api/entities/Order \
  -H "X-Api-Key: pxa_sk_..." \
  --data-urlencode 'q={"status":"open"}' --data-urlencode 'sort_by=-created_date'

JavaScript

const base = "https://<your app address>/api";
const headers = { "X-Api-Key": process.env.APP_API_KEY };

const q = encodeURIComponent(JSON.stringify({ status: "open" }));
const res = await fetch(`${base}/entities/Order?q=${q}&sort_by=-created_date`, { headers });
const orders = await res.json();

Python

import json, os, requests

BASE = "https://<your app address>/api"
HEADERS = {"X-Api-Key": os.environ["APP_API_KEY"]}

r = requests.get(f"{BASE}/entities/Order",
                 params={"q": json.dumps({"status": "open"}), "sort_by": "-created_date"},
                 headers=HEADERS)
r.raise_for_status()
orders = r.json()

Create a record, safely retried

Shell

curl -X POST https://<your app address>/api/entities/Lead \
  -H "X-Api-Key: pxa_sk_..." -H "Content-Type: application/json" \
  -H "Idempotency-Key: 6d1c0c2e-3b6a-4f7e-9a2b-0c1d2e3f4a5b" \
  -d '{"name": "Dana Patel", "email": "[email protected]", "source": "website"}'

JavaScript

const res = await fetch(`${base}/entities/Lead`, {
  method: "POST",
  headers: { ...headers, "Content-Type": "application/json", "Idempotency-Key": crypto.randomUUID() },
  body: JSON.stringify({ name: "Dana Patel", email: "[email protected]", source: "website" }),
});
if (!res.ok) { const err = await res.json(); throw new Error(err.error + ": " + err.message); }
const lead = await res.json();

Python

import uuid

r = requests.post(f"{BASE}/entities/Lead",
                  json={"name": "Dana Patel", "email": "[email protected]", "source": "website"},
                  headers={**HEADERS, "Idempotency-Key": str(uuid.uuid4())})
if not r.ok:
    err = r.json()
    raise SystemExit(f"{err['error']}: {err['message']}")
lead = r.json()

Update only if unchanged

JavaScript

const one = await fetch(`${base}/entities/Order/${id}`, { headers });
const etag = one.headers.get("ETag");

const upd = await fetch(`${base}/entities/Order/${id}`, {
  method: "PATCH",
  headers: { ...headers, "Content-Type": "application/json", "If-Match": etag },
  body: JSON.stringify({ status: "shipped" }),
});
if (upd.status === 412) { /* someone changed it first: read again and decide */ }

Page through everything

Python

cursor = None
while True:
    params = {"limit": 500}
    if cursor:
        params["cursor"] = cursor
    r = requests.get(f"{BASE}/entities/Booking", params=params, headers=HEADERS)
    r.raise_for_status()
    for row in r.json():
        handle(row)
    cursor = r.headers.get("X-Next-Cursor")
    if not cursor:
        break

Run a function

JavaScript

const run = await fetch(`${base}/functions/send_reminders`, {
  method: "POST",
  headers: { ...headers, "Content-Type": "application/json" },
  body: JSON.stringify({ before: "2026-06-13" }),
});
const { ok, result, run_id } = await run.json();

Handle rate limits

Python

import time

def call(method, url, **kw):
    for attempt in range(5):
        r = requests.request(method, url, headers=HEADERS, **kw)
        if r.status_code != 429:
            return r
        time.sleep(int(r.headers.get("Retry-After", "2")))
    return r

Was this page helpful?