API Reference

This catalog contains 64 public-only operations explicitly released by API CI. Its catalog, authentication, and schemas come only from the same artifact; every route not listed here remains private.

• API source commit: fea64ddee8d29d0f9296de5b046cb26ce0a96cdf
• OpenAPI SHA-256: 989e09de11d6a1accdf647db33b9b1dc24141458771dc4a69bc99ca8c083c2f0
• OpenAPI: 3.1.0

Storefront public reads（14）

• GET /api/v1/bootstrap — Get the public site bootstrap configuration
• GET /api/v1/catalog/categories — List public categories
• GET /api/v1/catalog/merchants/{merchantSlug}/products/{productSlug} — Get a public product for a store
• GET /api/v1/catalog/merchants/{slug}/categories — List public categories for a store
• GET /api/v1/catalog/merchants/{slug}/products — List public products for a store
• GET /api/v1/catalog/merchants/{slug} — Get a public store profile
• GET /api/v1/catalog/products/{slug} — Get a public product by slug
• GET /api/v1/catalog/products — List the public product catalog
• GET /api/v1/legal/documents — List current published legal documents by locale
• GET /api/v1/public/contact — Get public contact channels
• GET /api/v1/public/store-access/{store}/config — Get the public store security configuration
• GET /api/v1/runtime-config — Get the public runtime configuration
• GET /api/v1/search — Search public products
• GET /api/v1/storefront-decorations/merchants/{slug} — Get the published Storefront decoration

Official account and challenge endpoints（5）

• POST /api/v1/auth/password/reset/confirm — confirmOfficialPasswordReset
• POST /api/v1/auth/password/reset/request — requestOfficialPasswordReset
• POST /api/v1/auth/register — registerOfficialStorefrontCustomer
• POST /api/v1/public/store-access/{store}/challenges/verify — verifyStorefrontChallenge
• POST /api/v1/public/store-access/{store}/challenges — createStorefrontChallenge

Installation identity and readiness（2）

• GET /api/v1/open/installation/identity — Get the installation credential identity
• GET /api/v1/open/installation/readiness — Get the installation credential readiness

Hosted sessions and official browser flow（10）

• POST /api/v1/hosted/checkout/{sessionId}/cancel — Cancel the hosted checkout browser flow
• POST /api/v1/hosted/checkout/{sessionId}/projection — Get the hosted checkout browser projection
• POST /api/v1/hosted/checkout/{sessionId}/return — Return from the hosted checkout browser flow
• POST /api/v1/hosted/checkout/{sessionId}/ticket — Consume a hosted checkout browser ticket
• POST /api/v1/hosted/login/{flowId}/ticket — Consume a hosted login browser ticket
• POST /api/v1/open/hosted/checkout/sessions/{sessionId}/cancel — Cancel a hosted checkout session
• GET /api/v1/open/hosted/checkout/sessions/{sessionId} — Get a hosted checkout session
• POST /api/v1/open/hosted/checkout/sessions — Create a hosted checkout session
• POST /api/v1/open/hosted/login/initiate — Initiate a hosted login session
• POST /api/v1/open/hosted/login/return — Consume a hosted login return

API Key catalog reads（4）

• GET /api/v1/open/catalog/categories — List public categories with an API Key
• GET /api/v1/open/catalog/products/{slug} — Get a public product with an API Key
• GET /api/v1/open/catalog/products — List public products with an API Key
• GET /api/v1/open/identity — Get the current API Key identity and scopes

Storefront carts and quotes（13）

• PUT /api/v1/open/storefront/carts/{cartId}/address — setPublicCartAddress
• GET /api/v1/open/storefront/carts/{cartId}/checkout-quote — quotePublicCartCheckout
• POST /api/v1/open/storefront/carts/{cartId}/checkout — checkoutPublicCart
• POST /api/v1/open/storefront/carts/{cartId}/clear — clearPublicCart
• DELETE /api/v1/open/storefront/carts/{cartId}/items/{skuId} — removePublicCartItem
• PATCH /api/v1/open/storefront/carts/{cartId}/items/{skuId} — updatePublicCartItemQuantity
• POST /api/v1/open/storefront/carts/{cartId}/items — addPublicCartItem
• DELETE /api/v1/open/storefront/carts/{cartId}/promotion — removePublicCartPromotion
• PUT /api/v1/open/storefront/carts/{cartId}/promotion — applyPublicCartPromotion
• POST /api/v1/open/storefront/carts/{cartId}/quote — quotePublicCart
• POST /api/v1/open/storefront/carts/{cartId}/revoke — revokePublicCart
• GET /api/v1/open/storefront/carts/{cartId} — getPublicCart
• POST /api/v1/open/storefront/carts — createPublicCart

Storefront orders and after-sales（6）

• GET /api/v1/open/storefront/orders/{orderId}/after-sales-eligibility — getStorefrontOrderAfterSalesEligibility
• POST /api/v1/open/storefront/orders/{orderId}/after-sales — requestStorefrontOrderAfterSales
• GET /api/v1/open/storefront/orders/{orderId}/cancellation-eligibility — getStorefrontOrderCancellationEligibility
• POST /api/v1/open/storefront/orders/{orderId}/cancellations — cancelStorefrontOrder
• GET /api/v1/open/storefront/orders/{orderId} — getStorefrontOrder
• GET /api/v1/open/storefront/orders — listStorefrontOrders

Installation Webhooks（7）

• POST /api/v1/open/webhooks/deliveries/{id}/replay — replayInstallationWebhookDelivery
• GET /api/v1/open/webhooks/deliveries — listInstallationWebhookDeliveries
• GET /api/v1/open/webhooks/endpoints/{id}/signature-fixture — getInstallationWebhookSignatureFixture
• PATCH /api/v1/open/webhooks/endpoints/{id} — updateInstallationWebhook
• GET /api/v1/open/webhooks/endpoints — listInstallationWebhooks
• POST /api/v1/open/webhooks/endpoints — createInstallationWebhook
• GET /api/v1/open/webhooks/events — listInstallationWebhookEvents

OAuth PKCE and DPoP（3）

• GET /api/v1/oauth/authorize — describeOAuthAuthorization
• POST /api/v1/oauth/revoke — revokeOAuthToken
• POST /api/v1/oauth/token — exchangeOAuthToken

Published boundary

The artifact now includes OAuth PKCE/DPoP, installation Webhooks, cart quotes, and order read/cancellation/after-sales operations. Final order creation, payment execution, and a dedicated refund operation are not declared; hosted-checkout complete/continue is bound to the official session and CSRF and is not a third-party public API. This site invents no path or example for these capabilities.

Authoritative blockers

These statuses come from the same public-only artifact. They explain why a capability is not available; they do not imply that an endpoint exists.