Tillwire Read the guide
API reference

Every operation. Made from the code.

Built from the engine’s own OpenAPI file at each build of the site, so it says what the code says. Each operation needs a bearer token with its scope.

275operations that work
13in the contract, not built yet
33scopes
256paths

Base path /api/v1/. Header Authorization: Bearer <token>. The machine-readable file is at GET /api/v1/openapi.json on every store, with no token.

Announcements1 operations Catalogue88 operations Clients4 operations Content4 operations Customers4 operations Drafts10 operations Events1 operations Feeds1 operations Forms12 operations Mail39 operations Me1 operations Orders40 operations Payments8 operations Promotions5 operations Reviews2 operations Shipping16 operations Stock18 operations Store5 operations Subscriptions7 operations Supplier orders0 of 6 work Suppliers0 of 5 work Supply0 of 2 work Webhooks9 operations

All operations

Common parameters

Idempotency-KeyheaderMakes the write once. The key is the token's own: 1 to 255 visible ASCII characters. The same method, path, query and body bytes with the same key again within 24 hours get the first answer, marked Idempotent-Replay: true; another request with the same key is 409. A 5xx and a 429 are not kept, and the key is free again. While the first call runs, the answer is 409 with Retry-After: ask again with the same key.
afterqueryThe cursor of the page: Next-Cursor of the page before, as it is (opaque: follow the Link); the first page when left out.
pagequeryThe number of the page, from 1; the first when left out.

Errors

Every error has one body: error, message, code, field and request_id. Use code: the list only grows.

BadPageThe cursor is no cursor of this list or names an item that is gone (web.api_cursor), or the limit is out of its bounds (web.api_limit).
ConflictThe object is not as the call expects (a revision that is no longer current, or a state that does not allow the change); or, of a write with an Idempotency-Key: the key was used for another request (web.api_idempotency_differs); its first call is still being made (web.api_idempotency_busy, with Retry-After: ask again with the same key); or the outcome of its first call is not known, so it is never made again (web.api_idempotency_unknown: send a new key).
ConflictWriteThe object is not as the call expects (a revision that is no longer current, or a state that does not allow the change); or, of a write with an Idempotency-Key: the key was used for another request (web.api_idempotency_differs); its first call is still being made (web.api_idempotency_busy, with Retry-After: ask again with the same key); or the outcome of its first call is not known, so it is never made again (web.api_idempotency_unknown: send a new key).
ForbiddenThe token does not hold the scope of the operation's group.
ForbiddenWriteThe token does not hold the scope of the operation's group.
InvalidAn argument is wrong; the Problem names it in field.
InvalidWriteAn argument is wrong; the Problem names it in field.
MethodNotAllowedThe path takes other methods than the one called; Allow says them.
NotFoundThe object the path names does not exist.
NotFoundWriteThe object the path names does not exist.
RateLimitedThe token made more calls than its limit in the minute; Retry-After says when to call again.
TooLargeThe body is larger than the operation takes.
TooLargeWriteThe body is larger than the operation takes.
UnauthorizedThe call has no live token: none, unknown, revoked or expired.

Problem is the JSON the API door answers a refusal, and any failure, with.

coderequiredstring
errorrequiredstring
fieldstring
messagerequiredstring
request_idrequiredstring

Made from engine/internal/openapi/openapi.json at commit 6c4cbd921. The contract-only operations come from the engine’s stub file, engine/internal/ops.