Breww public API

Breww has an open API that anyone can use to build integrations with Breww.

API keys are used for authentication and are created in Settings -> Breww Apps & API. Keys belong to an app, so you'll create a private app first and then add keys to it. See the 'Apps in Breww' section below.

Documentation on the available endpoints, data structure and more can be found at Breww public API documentation.

The API uses the REST (Representational State Transfer) architecture with JSON responses.

Breww does not currently offer a SOAP or OData interface.

API key access levels

Each API key has a single access level that controls what it's allowed to do. There are only two options, and they apply to the entire key - there are no per-endpoint scopes or per-resource permissions on Breww API keys.

• Read only - the key can only make safe, non-modifying requests. In practice this means GET, HEAD and OPTIONS only. Any attempt to POST, PUT, PATCH or DELETE will be rejected. The one exception is the data explorer: running a report and starting an export are POST requests that only read data, so a read-only key can make them. See "Reporting and exports through the API" below.
• Full access - the key can make any request the public API supports, including reads, writes, updates and deletes. This is the default for new API keys.

Every endpoint listed in the public API documentation is reachable by any authenticated key, regardless of access level - the access level only controls which HTTP methods are allowed, not which endpoints are visible. There is no way to grant a key partial access to a subset of endpoints.

A key's access level is chosen when the key is created and can't be changed afterwards. If you need a different level, create a new key with the level you want and revoke the old one. You can see the access level of every key on its app's page in Settings -> Breww Apps & API.

Reporting and exports through the API

The data explorer endpoints give the API the same reporting as the Raw Data Explorer in Breww: totals, counts, averages and grouping across a whole data source, and filtered tables that include fields from related records. For example, total sales by customer this year is one request, instead of paging through every order and adding the values up yourself.

With the data explorer endpoints, an integration can:

• List the data sources and their fields, including your brewery's custom fields and the related records that more fields can be pulled from.
• Run a report on a data source, choosing the columns, grouping, aggregations, BrewwQL filter and sort order. Results are returned up to 200 rows per page. Each value comes back twice: as a plain value for your code to read, and as the text Breww displays for it in your brewery's format, currency and time zone.
• Run a saved report from the Raw Data Explorer, optionally with an extra filter that is applied as well as the report's own. Only saved reports that are shared with your brewery are available. See "Using saved reports with the API and AI assistants" in Reporting via the Aggregate Report Builder and Raw Data Explorer.
• Export a whole result to a file, as CSV or JSON Lines, with up to 1,000,000 rows. Breww builds the file in the background: your integration starts the export, checks its status until it is complete, then downloads the file or reads it back up to 200 rows at a time. The file is kept for 24 hours after the export completes.

Every export also has a download_page_url that you can pass on to a person. It opens Breww, where a signed-in user with the Reporting or All reporting permission and the Export reports and bulk data permission can download the file.

A few things to be aware of:

• Everything above works with a Read only key.
• In a filter sent through the API, a choice value such as an order's status is written with its English label, whatever language your brewery uses in Breww. For example: order_status = "Invoiced".
• Report runs are limited to 20 per minute and exports to 10 per hour, in addition to the API's normal rate limits. A brewery can have 2 exports in progress at once.

The request and response formats are in the Data explorer section of the Breww public API documentation.

Troubleshooting "endpoint not reachable" errors

If you're getting an error that suggests an endpoint is unreachable, blocked, or returning permission errors, the cause is almost always one of the following:

• A read-only key is being used for a write request. A 403 (or similar) on POST, PUT, PATCH or DELETE from a read-only key is expected behaviour, other than for the data explorer requests described above. Either change the key's access level to Full access or use a different key for write operations.
• The Authorization header is malformed. The header must be in the exact format documented in the API documentation. Missing the token prefix or sending the raw token without the prefix will be treated as an unauthenticated request.
• The base URL is wrong. All public API endpoints are under https://breww.com/api/.... Requests to other paths will not hit the API.
• The endpoint isn't part of the public API surface. Some functionality in Breww doesn't have a public API endpoint yet. If the endpoint isn't in the public API documentation, it isn't accessible to API keys, regardless of access level.

If you're still stuck after checking the above, get in touch with Breww support with the exact request URL, HTTP method, and the response Breww returned.

Apps in Breww

Before you can create an API key or an OAuth2 client, you need to create an app. An app holds your credentials and tells the Breww team what you're building. Go to Settings -> Breww Apps & API and click Create app. You'll need the Admin permission to manage apps.

The Apps page shows a Connecting Breww to an AI assistant? notice with a Set up Breww MCP button, which takes you to the Breww MCP page.

When creating an app you choose:

• App name - must be unique within your account.
• Description & notes for Breww team review - what your app does. Every app is reviewed by the Breww team, including private ones.
• App type - Private or Public, explained below. Register the correct type, as apps registered as the wrong type will be rejected.
• Integration category - which part of the integrations dashboard your app belongs in. Public apps only.

You also need to accept the App Developer Terms of Service, which are shown in the form and repeated on the app's own page for reference.

Each app's page shows Last user agent, the software that last used the app's credentials (or Not used yet), and AI assistant access, which reads Yes once an AI assistant has used the app.

App review statuses

• Pending review - submitted and waiting on the Breww team. You can start development while your app is pending.
• Approved - reviewed and accepted.
• Rejected - the reason is shown on the app's page. Update your description and use Resubmit for review to try again.

Apps created to connect an AI assistant to Breww are rejected. Use Breww MCP for that instead.

Private apps

A private app is for your own internal tools. It can only ever access your own Breww account, and it authenticates with API keys.

Create keys from the app's page with Create API key, giving each one a name to identify it and an access level. The token is shown in the keys table and can be copied at any time, and Last used tells you when it was last seen, updated every few minutes rather than instantly.

Revoke key stops that key working immediately and permanently. Anything still using it will lose access, so make sure you've switched over to a replacement first.

Public apps

A public app is for software you want other breweries to be able to connect to. Public apps use OAuth2 instead of API keys, so each brewery grants your app access to their own account and you never handle their login details.

Only a user with the Admin permission on a brewery's account can authorize a public app to connect to it.

Breww creates the OAuth2 credentials for you when the app is created:

• Client ID - always visible on the app's page.
• Client secret - shown once, immediately after it's generated. Copy it straight away, because Breww won't show it again. If you lose it, use Regenerate client secret, which issues a new one and stops the old one working immediately.
• Redirect URIs - the addresses Breww is allowed to send users back to after they authorise your app. Enter one per line. Breww validates these, so they must be full, valid URLs.

Public apps also have a Published content section, where you supply the description, help guide URL and logo that breweries see for your app on Breww's integrations dashboard. A logo is required. Any changes you make here are reviewed by the Breww team before they go live, and the page tells you while a review is pending.

Deleting an app

Delete app removes the app along with all of its API keys and OAuth2 credentials. Everything is revoked immediately, so any integration using them loses access straight away. This can't be undone.