> Production API availability: use /api/v1/help?view=guides and the resource operations catalog before following a recipe. Some localhost capabilities are not deployed yet; an absent operation is unavailable.
What this module owns
Store catalogs, product prices and the catalog projection used by generated-site checkout and access decisions.
Inspect the catalog before writing
Read stores, choose the owned store and inspect /catalog?databoard={objectid}. This connects source prices and content rules to the intended generated site. Write access and sync access use separate scopes.
To update a recurring price, POST /api/v1/ecommerce/products/{productid}/prices/{cycle}. Read the handler’s supported cycles and payload before writing; expected_current protects against changing an unexpected price. Keep Stripe secret values outside the board, Docs and patches.
Ebook-drafts links an owned Masterclass ebook to an unpublished product. Activate only after the manuscript and the entitlement policy have been reviewed. Catalog sync is a publishing side effect. Validate guest access, a paying buyer, a different buyer, refunds and subscription lifecycle separately; catalog JSON checks do not certify payments.
First read
Use API_URL with /api/v1, for example http://localhost/api/v1. Set API_KEY privately. Replace any resource placeholder with an ID returned by discovery.
curl --fail-with-body "$API_URL/ecommerce/stores" \
-H "Authorization: Bearer $API_KEY"Registered agent routes
The entries below are extracted from the current route and handler source. Scope tokens can represent alternatives or different method branches, not a requirement to grant every listed scope. Body fields are observed inputs, not a complete required-field schema. Follow the resource guide and the deployed validation response for a write.
/api/v1/ecommerce/stores
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: GET. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: ecommerce:read
Selected rejection messages:
- GET required
/api/v1/ecommerce/stores/{storeid}/catalog
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: GET. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: ecommerce:read
Selected rejection messages:
- GET required
- Invalid Databoard id
- Unable to inspect Ecommerce catalog
/api/v1/ecommerce/stores/{storeid}/ebook-drafts
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: ecommerce:write, masterclass:read
Observed JSON fields: currency, ebook_id, price_cents, slug.
Selected rejection messages:
- POST required
- Invalid store id
- ebook_id, slug, integer price_cents and CAD currency are required
- Owned store or ebook not found
- Store and ebook must share a group
- Existing ebook product differs; review it in Ecommerce
- Product slug already exists
/api/v1/ecommerce/stores/{storeid}/ebooks/{ebookid}/activate
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: ecommerce:write, masterclass:read
Observed JSON fields: confirm.
Selected rejection messages:
- POST required
- Invalid store or ebook id
- confirm=activate_ebook is required
- Owned store or ebook not found
- Ebook must be published in the store group
- Linked one-time CAD ebook product is not ready
- Product cannot be activated
/api/v1/ecommerce/stores/{storeid}/sync
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: ecommerce:sync
Observed JSON fields: databoard_id.
Selected rejection messages:
- POST required
- databoard_id is required
- Unable to sync Ecommerce catalog
/api/v1/ecommerce/products/{productid}/prices/{cycle}
Unavailable in this production release. This reference describes a pending capability. Do not call this endpoint; use deployed discovery to check availability. Intended request methods: POST. Confirm allowed_methods and method_evidence in the deployed operations catalog; documented methods do not grant access.
Scope tokens in the implementation: ecommerce:write
Observed JSON fields: expected_current, stripe_price_id.
Selected rejection messages:
- POST required
- Invalid product or cycle
- expected_current is required
- A Stripe Price ID is required
- Unable to update Ecommerce price
Access boundary
External agents use only the versioned operations documented above and returned by the deployed catalog. Browser actions and internal controllers are not substitutes for missing API operations.
Verification before automation
Read back the owned record after a write. On a dedicated local fixture, test missing input, wrong owner, missing scope and stale revisions where supported. Confirm the request did not change state when rejected. Check the generated projection separately from the source record. Never replay sends, payments or deletion requests merely to test connectivity.
See API validation and remaining gaps for the shared test strategy.
HTTP discovery and safety contract
Read GET /api/v1/help?view=guide&resource=ecommerce for this module's machine-readable guidance. Discover supported operations through its discovery_url when present. A null discovery_url means no direct resource API is documented; related endpoints, when provided, have their own ownership and scope requirements.
Use GET /api/v1/me with your key to confirm identity and scopes. Only request methods and fields supported by this deployment. The shared transport boundary rejects unsupported methods and malformed JSON on covered routes, but field schemas and revision checks remain resource-specific. Notes and Carousels expose typed save schemas and payload-only validation; other modules must not be assumed to share that contract.
Create, update, replace, patch, delete, send and publish are distinct capabilities. An operation absent from the returned catalog is unavailable, not permission to guess a URL. Read back after writes; after a timeout inspect the result before retrying. Never automatically replay a payment, message, deployment or deletion.