NCR Counterpoint API Endpoints

The NCR Counterpoint integration reads from and writes to Counterpoint through CPHive, a web service installed alongside Counterpoint on the subscriber's own server. This article lists every CPHive endpoint the integration calls.

Subscribers do not call these endpoints themselves — iPaaS.com does, on their behalf, as records move between Counterpoint and the other systems in the integration. The inventory is published for reference: to confirm which parts of the CPHive service the integration depends on, and to check at a glance whether a given endpoint is still in use.

The running CPHive service also publishes its own interactive reference on the server where it is installed, listing every endpoint the service exposes together with their request and response shapes. Where this article and that reference differ, the reference on the running service describes the exact build in front of you.

The integration requests a token from CPHive at the /token endpoint, identifying itself with the CP Api Username from the subscription, and presents that token on subsequent requests. The token is stored and reused across transfers rather than being requested each time; the integration asks for a new one only when CPHive signals that the current one is no longer accepted.

What protects CPHive is where it is published, not this token. CPHive runs on the subscriber's own server and reads and writes the Counterpoint database directly, so the controls that matter are the ones around the address it is published at: a valid certificate, and inbound traffic restricted to the sources that need to reach it. Subscribers or their MiSP should treat those as the access control for this service and confirm they are in place before go-live — they are covered in NCR Counterpoint Installation Instructions.

The CP Api Key on the subscription is not used on these calls. Note that it is also not the key the CPWebhooks service needs — that is a separate webhook key generated by iPaaS.com for the subscription, not a value typed into this field. See the NCR Counterpoint Installation Instructions for where the CPWebhooks key comes from.

The address the integration calls is the CP Api Url from the subscription. The credentials themselves are covered in NCR Counterpoint Connections and Settings.

Most resources follow the same three shapes, so the pattern is worth stating once rather than repeating on every line:

The value in braces in each path — for example the customer number or item number — is supplied by the integration when it makes the call. The names shown are the identifiers CPHive expects; they are not values a subscriber types.

The /token endpoint is the authentication call described above. /IPaasSubscription reads and writes the Counterpoint-side webhook subscriptions that decide which changes raise a notification — see NCR Counterpoint Known Limitations for how those subscriptions behave. /TableData is a general-purpose read used internally by the integration.

CPHive does not page its responses. A read of a whole set returns every record that matches, in one reply — there is no page size, page number or continuation token to work through, and no partial result to detect.

The way a read is narrowed is the filter described above. A read with no filter returns the entire table, so on a large table — items, customers, inventory — an unfiltered read is the most expensive request the service can be asked to make, and it competes with point-of-sale activity on the same database.

Which reads are filtered is decided by the integration rather than configured on the subscription. Several reference-data reads — locations, pay codes, ship-via codes, categories — are deliberately unfiltered, because the whole set is wanted. This is worth keeping in mind alongside the guidance below.

CPHive runs on the subscriber's own server rather than behind a shared gateway, so it publishes no request quota or rate limit. The practical limit is the capacity of that server and its database. Because Counterpoint is a live retail system, subscribers or their MiSP should schedule large transfers outside trading hours and avoid running several intensive jobs at once, as covered in NCR Counterpoint Connections and Settings.