Third-party Storefront public API
This entry contains 37 published operations relevant to third-party Storefronts, including catalog reads, hosted backend foundations, carts/quotes, and order read/cancellation/after-sales. These links use the same generated pages as the general API Reference; resources without paths below are not yet available.
- API source commit:
d09b20088ddf112ca33b995a325a37b9a25214d8 - OpenAPI SHA-256:
6da10d0a4841540253c476b1e4a5f5f42c52fa5f20ef975a4c46dc6e7323fb5a
Hosted redirect boundary
Catalog reads remain on the third-party site. The artifact now provides hosted login/checkout backend foundations plus carts, address tokens, promotions, unified quotes, and order read/cancellation/after-sales operations; it still does not declare official hosted UI, final order creation, or payment execution. Future browser flows may only use top-level redirects to official Ayalink hosted pages and return to an exact platform-reviewed return URL. A third party must not collect passwords/MFA, forward Ayalink Cookies, handle payment credentials, or proxy a hosted page.
Store identity and bootstrap
GET /api/v1/runtime-config— Get the public runtime configurationGET /api/v1/bootstrap— Get the public site bootstrap configurationGET /api/v1/public/contact— Get public contact channelsGET /api/v1/catalog/merchants/{slug}— Get a public store profile
Configuration and decoration
GET /api/v1/public/store-access/{store}/config— Get the public store security configurationGET /api/v1/storefront-decorations/merchants/{slug}— Get the published Storefront decoration
Categories
GET /api/v1/catalog/categories— List public categoriesGET /api/v1/catalog/merchants/{slug}/categories— List public categories for a store
Products
GET /api/v1/catalog/products— List the public product catalogGET /api/v1/catalog/products/{slug}— Get a public product by slugGET /api/v1/catalog/merchants/{slug}/products— List public products for a storeGET /api/v1/catalog/merchants/{merchantSlug}/products/{productSlug}— Get a public product for a store
Search
Public legal content
Hosted login backend sessions
POST /api/v1/open/hosted/login/initiate— Initiate a hosted login sessionPOST /api/v1/open/hosted/login/return— Consume a hosted login return
Hosted checkout backend sessions
POST /api/v1/open/hosted/checkout/sessions— Create a hosted checkout sessionGET /api/v1/open/hosted/checkout/sessions/{sessionId}— Get a hosted checkout sessionPOST /api/v1/open/hosted/checkout/sessions/{sessionId}/cancel— Cancel a hosted checkout session
Carts, address tokens, and unified quotes
PUT /api/v1/open/storefront/carts/{cartId}/address— setPublicCartAddressGET /api/v1/open/storefront/carts/{cartId}/checkout-quote— quotePublicCartCheckoutPOST /api/v1/open/storefront/carts/{cartId}/checkout— checkoutPublicCartPOST /api/v1/open/storefront/carts/{cartId}/clear— clearPublicCartDELETE /api/v1/open/storefront/carts/{cartId}/items/{skuId}— removePublicCartItemPATCH /api/v1/open/storefront/carts/{cartId}/items/{skuId}— updatePublicCartItemQuantityPOST /api/v1/open/storefront/carts/{cartId}/items— addPublicCartItemDELETE /api/v1/open/storefront/carts/{cartId}/promotion— removePublicCartPromotionPUT /api/v1/open/storefront/carts/{cartId}/promotion— applyPublicCartPromotionPOST /api/v1/open/storefront/carts/{cartId}/quote— quotePublicCartPOST /api/v1/open/storefront/carts/{cartId}/revoke— revokePublicCartGET /api/v1/open/storefront/carts/{cartId}— getPublicCartPOST /api/v1/open/storefront/carts— createPublicCart
Order reads, cancellation, and after-sales
GET /api/v1/open/storefront/orders/{orderId}/after-sales-eligibility— getStorefrontOrderAfterSalesEligibilityPOST /api/v1/open/storefront/orders/{orderId}/after-sales— requestStorefrontOrderAfterSalesGET /api/v1/open/storefront/orders/{orderId}/cancellation-eligibility— getStorefrontOrderCancellationEligibilityPOST /api/v1/open/storefront/orders/{orderId}/cancellations— cancelStorefrontOrderGET /api/v1/open/storefront/orders/{orderId}— getStorefrontOrder
Resource groups not yet available
The current artifact has no operations for these resources, so this site generates no endpoint, parameter, scope, or response:
- Official hosted login UI — Not yet available
- Official hosted checkout UI and payment execution — Not yet available
- Final order creation — Not yet available
- Dedicated refund operation — Not yet available
- Dedicated pricing resource — Not yet available
- Dedicated media resource — Not yet available
Price, media, or inventory-related fields in a product schema do not imply a dedicated resource API. Use only the schema actually declared on each operation page.
Turnstile trust boundary
Limit Turnstile to bot protection on official sign-in and authorization endpoints, not proof of site authenticity or login.
Third-party account authorization boundary
Use the official authorization domain, PKCE S256, and isolated app grants without exposing account credentials to a proxy.