API Reference

This catalog contains 25 public-only operations explicitly released by API CI: 14 Storefront public reads, 2 installation identity/readiness reads, 5 hosted backend session foundation operations, and 4 API Key catalog reads. Every route not listed here remains private.

• API source commit: 2d63ab5caa6d65c1ea9fe253c5bdfbec77b2a170
• OpenAPI SHA-256: 33f52714521cbd7573bcc808c38dd8dc189d7bafa2fd3a6d4c914b70853357b2
• OpenAPI: 3.1.0

Storefront public reads

• GET /api/v1/runtime-config — Get the public runtime configuration
• GET /api/v1/bootstrap — Get the public site bootstrap configuration
• GET /api/v1/public/contact — Get public contact channels
• GET /api/v1/legal/documents — List current published legal documents by locale
• GET /api/v1/storefront-decorations/merchants/{slug} — Get the published Storefront decoration
• GET /api/v1/public/store-access/{store}/config — Get the public store security configuration
• GET /api/v1/search — Search public products
• GET /api/v1/catalog/categories — List public categories
• GET /api/v1/catalog/products — List the public product catalog
• GET /api/v1/catalog/products/{slug} — Get a public product by slug
• GET /api/v1/catalog/merchants/{slug} — Get a public store profile
• GET /api/v1/catalog/merchants/{slug}/products — List public products for a store
• GET /api/v1/catalog/merchants/{slug}/categories — List public categories for a store
• GET /api/v1/catalog/merchants/{merchantSlug}/products/{productSlug} — Get a public product for a store

Installation identity and readiness

• GET /api/v1/open/installation/identity — Get the installation credential identity
• GET /api/v1/open/installation/readiness — Get the installation credential readiness

Hosted backend session foundations

• POST /api/v1/open/hosted/login/initiate — Initiate a hosted login session
• POST /api/v1/open/hosted/login/return — Consume a hosted login return
• POST /api/v1/open/hosted/checkout/sessions — Create a hosted checkout session
• GET /api/v1/open/hosted/checkout/sessions/{sessionId} — Get a hosted checkout session
• POST /api/v1/open/hosted/checkout/sessions/{sessionId}/cancel — Cancel a hosted checkout session

API Key catalog reads

• GET /api/v1/open/identity — Get the current API Key identity and scopes
• GET /api/v1/open/catalog/categories — List public categories with an API Key
• GET /api/v1/open/catalog/products — List public products with an API Key
• GET /api/v1/open/catalog/products/{slug} — Get a public product with an API Key

Capabilities not published

OAuth, Turnstile, installation writes, and Webhook management are absent from this artifact, so this site generates no endpoints for them. Hosted operations provide only backend session security foundations; official UI, final order creation, provider payment progression, production configuration, and migrations are not complete, so payment must not be treated as available.

Authoritative blockers

These statuses come from the same public-only artifact. They explain why a capability is not available; they do not imply that an endpoint exists.