- Every call except the two token endpoints needs
Authorization: Bearer <access token>— see authentication. - A token is valid at exactly one store, and each endpoint needs one of the token’s scopes.
- Prices are always computed by matgrk — a client never sends one.
Tokens
- POST
/v1/auth/anonymousExchange an API key for access and refresh tokens - POST
/v1/auth/refreshRotate the token pair with a refresh token
Catalogue
Required scope: catalogue:read
- GET
/v1/catalogue/productsList the store’s products - GET
/v1/catalogue/product/{slug}One product by its slug - GET
/v1/catalogue/products-by-idsProducts for a list of ids
Search and branches
Required scope: search:read
- GET
/v1/search/suggestSuggestions for a partial query - GET
/v1/search/contextContext for a search results page - GET
/v1/branchesThe store’s branches
Cart
Required scope: cart:read, cart:write
- GET
/v1/cartThe current cart - POST
/v1/cartCreate a cart - POST
/v1/cart/linesAdd a line to the cart - PATCH
/v1/cart/lines/{lineId}Change a cart line - DELETE
/v1/cart/lines/{lineId}Remove a cart line - POST
/v1/cart/couponApply a coupon - DELETE
/v1/cart/couponRemove the coupon
Checkout
Required scope: checkout:write
- POST
/v1/checkout/delivery-optionsDelivery options for the cart - POST
/v1/checkout/payment-optionsPayment options for the cart - POST
/v1/checkout/quoteA priced quote for the cart - PATCH
/v1/checkout/detailsSet shopper and delivery details - PUT
/v1/checkout/fulfilmentChoose the fulfilment method - GET
/v1/checkout/collection-branchesBranches offering collection - POST
/v1/checkout/placePlace the order - GET
/v1/checkout/confirmationConfirmation of a placed order - POST
/v1/checkout/returnedReturn from a payment gateway redirect
Shopper accounts
Required scope: account:read, account:write
- POST
/v1/account/registerRegister a shopper account - POST
/v1/account/sign-inSign a shopper in - POST
/v1/account/sign-outSign the shopper out - POST
/v1/account/otp/requestRequest a one-time code - POST
/v1/account/otp/verifyVerify a one-time code - POST
/v1/account/passwordChange the password - POST
/v1/account/password-resetStart a password reset - POST
/v1/account/verify-emailVerify the shopper’s email - GET
/v1/accountThe shopper profile - GET
/v1/account/addressesThe shopper’s addresses - POST
/v1/account/addressesAdd an address - PATCH
/v1/account/addresses/{addressId}Change an address - DELETE
/v1/account/addresses/{addressId}Delete an address
Orders
Required scope: orders:read
- GET
/v1/ordersThe signed-in shopper’s orders
Quoting and placing orders carry their own per-cart and per-shopper throttles on top of the key’s rate limit — see conventions.