Third-party Storefront public API
The current artifact contains 14 Storefront public operations. These links use the same generated pages as the general API Reference; resources without paths below are not yet available.
- API source commit:
5912605d35f2384bd6bbd4b868b87afeedac6a96 - OpenAPI SHA-256:
c7bd778d077f80f71ece290839a6b984aeef824c2a774510e882a617afecd644
Hosted redirect boundary
Catalog reads remain on the third-party site. Sign-in/registration and checkout/payment may only use future top-level redirects to official Ayalink hosted pages, returning to an exact platform-reviewed return URL. Neither hosted capability is in the current artifact, so this site provides no URL or example. A third party must not collect passwords/MFA, forward Ayalink Cookies, handle payment credentials, or proxy a hosted page.
Store identity and bootstrap
GET /api/v1/runtime-config— Get the public runtime configurationGET /api/v1/bootstrap— Get the public site bootstrap configurationGET /api/v1/public/contact— Get public contact channelsGET /api/v1/catalog/merchants/{slug}— Get a public store profile
Configuration and decoration
GET /api/v1/public/store-access/{store}/config— Get the public store security configurationGET /api/v1/storefront-decorations/merchants/{slug}— Get the published Storefront decoration
Categories
GET /api/v1/catalog/categories— List public categoriesGET /api/v1/catalog/merchants/{slug}/categories— List public categories for a store
Products
GET /api/v1/catalog/products— List the public product catalogGET /api/v1/catalog/products/{slug}— Get a public product by slugGET /api/v1/catalog/merchants/{slug}/products— List public products for a storeGET /api/v1/catalog/merchants/{merchantSlug}/products/{productSlug}— Get a public product for a store
Search
Public legal content
Resource groups not yet available
The current artifact has no operations for these resources, so this site generates no endpoint, parameter, scope, or response:
- Hosted sign-in and registration — Not yet available
- Hosted checkout and payment — Not yet available
- SKU and sellable inventory — Not yet available
- Dedicated pricing resource — Not yet available
- Locale and fallback — Not yet available
- Media resources — Not yet available
Price, media, or inventory-related fields in a product schema do not imply a dedicated resource API. Use only the schema actually declared on each operation page.
Turnstile trust boundary
Limit Turnstile to bot protection on official sign-in and authorization endpoints, not proof of site authenticity or login.
Third-party account authorization boundary
Use the official authorization domain, PKCE S256, and isolated app grants without exposing account credentials to a proxy.