This document lists the Square API endpoints the iPaaS.com integration calls, grouped by entity. Use it as a reference for firewall allow-listing, API-scope configuration, troubleshooting, and to determine whether the integration is affected when Square publishes a change to its API.

Square applications and their credentials are managed in the Square Developer Dashboard at https://developer.squareup.com. Each application's Credentials page provides the Sandbox and Production access tokens used to connect (see the Square Connections and Settings article).

Square exposes a REST API. The integration calls the Square Connect v2 API, with the base URL determined by the environment configured in the subscription's API URL setting:

Endpoint paths below are shown with a [Base URL] prefix that stands for the environment base URL above. Square manages API versioning through the Square-Version request header rather than the URL path.

Retrieves a Square customer by its identifier. Used when recording a Square customer in iPaaS.com, including when a customer is transferred as a prerequisite of an order.

Retrieves a Square order by its identifier. Used when recording a Square order in iPaaS.com as a transaction.

Products, product variations, options, option values, and categories are all Square catalog objects and are accessed through the catalog endpoints.

Searches the Square catalog. Used to find a product or variation by SKU — for example, to confirm that an order's line-item products already exist in Square, and to match an existing Square item before writing a product.

Retrieves a single catalog object — a product, variation, option, or category — by its identifier. Used to read an item's SKU, resolve a product's category hierarchy, and fetch the current catalog version before an update.

Creates or updates a catalog object. Used to write iPaaS.com products, variations, options, and option values to Square.

Lists catalog objects of a given type. Used to retrieve the existing Square product options and their values. Results are paginated with a cursor (see Pagination).

Retrieves a Square location by its identifier. Used to resolve the location name recorded on an order.

The integration manages the Square webhook subscriptions that drive automatic order transfers.

Lists the webhook subscriptions registered for the Square application.

Registers a webhook subscription so Square notifies iPaaS.com of order events.

Updates an existing webhook subscription.

Removes a webhook subscription.

Exchanges the authorization granted in Square for an access token and a refresh token, and later exchanges the refresh token for a new access token when the current one expires. See Authentication.

Square uses OAuth 2.0. After the subscriber authorizes the integration in Square, iPaaS.com holds an access token and a refresh token; API calls are made with the access token as a bearer credential. Access tokens are short-lived, and the integration uses the refresh token to obtain a new access token automatically through the Authorization Endpoint above. See the Square Connections and Settings article for the authorization steps.

List responses are paginated with a cursor. When more results exist, Square returns a cursor value; the integration passes it back as the cursor query parameter (for GET requests) or request-body field (for POST requests) to retrieve the next page, until no cursor is returned. A cursor is valid for a limited time (Square expires cursors after 5 minutes), so pages are retrieved in sequence.

Square applies adaptive rate limiting rather than a fixed published request-per-second limit, and returns HTTP 429 when the current limit is exceeded. When this happens, the integration automatically reschedules the transfer to resume shortly after, so no subscriber action is required. The volume the integration sends is bounded by the API Throttle Limit, API Throttle Seconds, Concurrent Connections, and Concurrent Batch Executions settings on the subscription (see the Square Connections and Settings article).