[{"data":1,"prerenderedAt":637},["ShallowReactive",2],{"navigation_docs_zh":3,"-zh-getting-started-enterprise-integration":208,"-zh-getting-started-enterprise-integration-surround":632},[4,22,40,50,64,82,180,194],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":21},"快速开始","i-lucide-rocket","\u002Fzh\u002Fgetting-started","zh\u002F1.getting-started",[10,13,17],{"title":5,"path":11,"stem":12},"\u002Fzh\u002Fgetting-started\u002Fquick-start","zh\u002F1.getting-started\u002F1.quick-start",{"title":14,"path":15,"stem":16},"信任模型","\u002Fzh\u002Fgetting-started\u002Ftrust-model","zh\u002F1.getting-started\u002F2.trust-model",{"title":18,"path":19,"stem":20},"大客户端到端接入指南","\u002Fzh\u002Fgetting-started\u002Fenterprise-integration","zh\u002F1.getting-started\u002F3.enterprise-integration",false,{"title":23,"icon":24,"path":25,"stem":26,"children":27,"page":21},"自研 Storefront","i-lucide-store","\u002Fzh\u002Fstorefront","zh\u002F2.storefront",[28,32,36],{"title":29,"path":30,"stem":31},"第三方 Storefront","\u002Fzh\u002Fstorefront\u002Fthird-party-storefront","zh\u002F2.storefront\u002F1.third-party-storefront",{"title":33,"path":34,"stem":35},"Turnstile 的信任边界","\u002Fzh\u002Fstorefront\u002Fchallenge-and-turnstile","zh\u002F2.storefront\u002F2.challenge-and-turnstile",{"title":37,"path":38,"stem":39},"第三方店铺前端公共 API","\u002Fzh\u002Fstorefront\u002Fpublic-api","zh\u002F2.storefront\u002F3.public-api",{"title":41,"icon":42,"path":43,"stem":44,"children":45,"page":21},"OAuth 与身份","i-lucide-key-round","\u002Fzh\u002Foauth","zh\u002F3.oauth",[46],{"title":47,"path":48,"stem":49},"第三方账号授权安全边界","\u002Fzh\u002Foauth\u002Fauthorization-code-pkce","zh\u002F3.oauth\u002F1.authorization-code-pkce",{"title":51,"icon":52,"path":53,"stem":54,"children":55,"page":21},"开发者平台","i-lucide-blocks","\u002Fzh\u002Fplatform","zh\u002F4.platform",[56,60],{"title":57,"path":58,"stem":59},"应用、版本、安装与 Scope","\u002Fzh\u002Fplatform\u002Fapps-installations-scopes","zh\u002F4.platform\u002F1.apps-installations-scopes",{"title":61,"path":62,"stem":63},"Origin、Redirect、反向代理与环境","\u002Fzh\u002Fplatform\u002Fsecurity-and-environments","zh\u002F4.platform\u002F2.security-and-environments",{"title":65,"icon":66,"path":67,"stem":68,"children":69,"page":21},"运行时扩展","i-lucide-workflow","\u002Fzh\u002Fruntime","zh\u002F5.runtime",[70,74,78],{"title":71,"path":72,"stem":73},"安装级 Webhook","\u002Fzh\u002Fruntime\u002Fwebhooks","zh\u002F5.runtime\u002F1.webhooks",{"title":75,"path":76,"stem":77},"库存同步","\u002Fzh\u002Fruntime\u002Finventory-sync","zh\u002F5.runtime\u002F2.inventory-sync",{"title":79,"path":80,"stem":81},"自动发货 Provider","\u002Fzh\u002Fruntime\u002Fauto-fulfillment","zh\u002F5.runtime\u002F3.auto-fulfillment",{"title":83,"icon":84,"path":85,"stem":86,"children":87,"page":21},"API 参考","i-lucide-braces","\u002Fzh\u002Freference","zh\u002F6.reference",[88,91,95],{"title":83,"path":89,"stem":90},"\u002Fzh\u002Freference\u002Fapi","zh\u002F6.reference\u002F1.api",{"title":92,"path":93,"stem":94},"错误、幂等与限流","\u002Fzh\u002Freference\u002Ferrors-and-limits","zh\u002F6.reference\u002F2.errors-and-limits",{"title":96,"path":97,"stem":98,"children":99,"page":21},"Endpoint 目录","\u002Fzh\u002Freference\u002Foperations","zh\u002F6.reference\u002F3.operations",[100,104,108,112,116,120,124,128,132,136,140,144,148,152,156,160,164,168,172,176],{"title":101,"path":102,"stem":103},"读取公开运行配置","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-runtime-config","zh\u002F6.reference\u002F3.operations\u002F01.get-public-runtime-config",{"title":105,"path":106,"stem":107},"读取公开站点启动配置","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-bootstrap","zh\u002F6.reference\u002F3.operations\u002F02.get-public-bootstrap",{"title":109,"path":110,"stem":111},"读取公开联系渠道","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-contact","zh\u002F6.reference\u002F3.operations\u002F03.get-public-contact",{"title":113,"path":114,"stem":115},"按语言读取当前已发布法律正文","\u002Fzh\u002Freference\u002Foperations\u002Flist-public-legal-documents","zh\u002F6.reference\u002F3.operations\u002F04.list-public-legal-documents",{"title":117,"path":118,"stem":119},"读取店铺已发布装修","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-storefront-decoration","zh\u002F6.reference\u002F3.operations\u002F05.get-public-storefront-decoration",{"title":121,"path":122,"stem":123},"读取店铺公开安全配置","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-store-security-config","zh\u002F6.reference\u002F3.operations\u002F06.get-public-store-security-config",{"title":125,"path":126,"stem":127},"搜索可公开销售商品","\u002Fzh\u002Freference\u002Foperations\u002Fsearch-public-products","zh\u002F6.reference\u002F3.operations\u002F07.search-public-products",{"title":129,"path":130,"stem":131},"读取公开分类","\u002Fzh\u002Freference\u002Foperations\u002Flist-public-categories","zh\u002F6.reference\u002F3.operations\u002F08.list-public-categories",{"title":133,"path":134,"stem":135},"读取安装级凭据绑定身份","\u002Fzh\u002Freference\u002Foperations\u002Fget-installation-credential-identity","zh\u002F6.reference\u002F3.operations\u002F09.get-installation-credential-identity",{"title":137,"path":138,"stem":139},"读取安装级凭据就绪与阻塞事实","\u002Fzh\u002Freference\u002Foperations\u002Fget-installation-credential-readiness","zh\u002F6.reference\u002F3.operations\u002F10.get-installation-credential-readiness",{"title":141,"path":142,"stem":143},"读取公开商品目录","\u002Fzh\u002Freference\u002Foperations\u002Flist-public-products","zh\u002F6.reference\u002F3.operations\u002F11.list-public-products",{"title":145,"path":146,"stem":147},"按 slug 读取公开商品","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-product","zh\u002F6.reference\u002F3.operations\u002F12.get-public-product",{"title":149,"path":150,"stem":151},"读取公开店铺资料","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-merchant","zh\u002F6.reference\u002F3.operations\u002F13.get-public-merchant",{"title":153,"path":154,"stem":155},"读取店铺公开商品","\u002Fzh\u002Freference\u002Foperations\u002Flist-public-merchant-products","zh\u002F6.reference\u002F3.operations\u002F14.list-public-merchant-products",{"title":157,"path":158,"stem":159},"读取店铺公开分类","\u002Fzh\u002Freference\u002Foperations\u002Flist-public-merchant-categories","zh\u002F6.reference\u002F3.operations\u002F15.list-public-merchant-categories",{"title":161,"path":162,"stem":163},"读取店铺公开商品详情","\u002Fzh\u002Freference\u002Foperations\u002Fget-public-merchant-product","zh\u002F6.reference\u002F3.operations\u002F16.get-public-merchant-product",{"title":165,"path":166,"stem":167},"读取当前 API Key 的标识与 scope","\u002Fzh\u002Freference\u002Foperations\u002Fget-api-key-identity","zh\u002F6.reference\u002F3.operations\u002F17.get-api-key-identity",{"title":169,"path":170,"stem":171},"通过 API Key 读取公开分类","\u002Fzh\u002Freference\u002Foperations\u002Flist-api-key-catalog-categories","zh\u002F6.reference\u002F3.operations\u002F18.list-api-key-catalog-categories",{"title":173,"path":174,"stem":175},"通过 API Key 读取公开商品目录","\u002Fzh\u002Freference\u002Foperations\u002Flist-api-key-catalog-products","zh\u002F6.reference\u002F3.operations\u002F19.list-api-key-catalog-products",{"title":177,"path":178,"stem":179},"通过 API Key 读取公开商品","\u002Fzh\u002Freference\u002Foperations\u002Fget-api-key-catalog-product","zh\u002F6.reference\u002F3.operations\u002F20.get-api-key-catalog-product",{"title":181,"icon":182,"path":183,"stem":184,"children":185,"page":21},"示例","i-lucide-code-xml","\u002Fzh\u002Fexamples","zh\u002F7.examples",[186,190],{"title":187,"path":188,"stem":189},"最小 Nuxt Storefront","\u002Fzh\u002Fexamples\u002Fnuxt-storefront","zh\u002F7.examples\u002F1.nuxt-storefront",{"title":191,"path":192,"stem":193},"Webhook 验签","\u002Fzh\u002Fexamples\u002Fwebhook-verification","zh\u002F7.examples\u002F2.webhook-verification",{"title":195,"icon":196,"path":197,"stem":198,"children":199,"page":21},"版本与支持","i-lucide-life-buoy","\u002Fzh\u002Foperations","zh\u002F8.operations",[200,204],{"title":201,"path":202,"stem":203},"版本、迁移与变更记录","\u002Fzh\u002Foperations\u002Fversions-and-migrations","zh\u002F8.operations\u002F1.versions-and-migrations",{"title":205,"path":206,"stem":207},"支持与安全披露","\u002Fzh\u002Foperations\u002Fsupport-and-security","zh\u002F8.operations\u002F2.support-and-security",{"id":209,"title":18,"body":210,"description":625,"extension":626,"links":627,"meta":628,"navigation":629,"path":19,"seo":630,"stem":20,"__hash__":631},"docs_zh\u002Fzh\u002F1.getting-started\u002F3.enterprise-integration.md",{"type":211,"value":212,"toc":608},"minimark",[213,234,238,241,301,305,310,330,336,340,345,348,353,357,362,373,380,386,390,395,409,412,416,421,424,437,442,446,451,468,502,506,511,514,518,523,526,539,543,548,551,556,560,565,586,590,595,598,601,605],[214,215,216,217,221,222,225,226,229,230,233],"p",{},"这是一条上线决策路径，不是 endpoint 清单。每个阶段都明确区分 ",[218,219,220],"strong",{},"已开放","、",[218,223,224],{},"需要平台开通"," 与 ",[218,227,228],{},"尚未开放","；只有 ",[231,232,83],"a",{"href":89}," 中来自 public-only artifact 的操作才视为已开放。",[235,236,237],"h2",{"id":237},"当前权威阻塞快照",[214,239,240],{},"API public-only artifact 明确给出五类阻塞。它们只解释为什么能力尚未开放，不表示 endpoint 已存在：",[242,243,244,257],"table",{},[245,246,247],"thead",{},[248,249,250,254],"tr",{},[251,252,253],"th",{},"能力",[251,255,256],{},"当前阻塞原因",[258,259,260,269,277,285,293],"tbody",{},[248,261,262,266],{},[263,264,265],"td",{},"OAuth Authorization Code",[263,267,268],{},"仍需 DPoP 与 resource\u002Finstallation 绑定",[248,270,271,274],{},[263,272,273],{},"Installation 写入 API",[263,275,276],{},"仍需 sender-constrained installation credential",[248,278,279,282],{},[263,280,281],{},"订单 API",[263,283,284],{},"仍需租户隔离的公开订单契约",[248,286,287,290],{},[263,288,289],{},"Webhook 订阅 API",[263,291,292],{},"仍需 installation-bound credential",[248,294,295,298],{},[263,296,297],{},"生产启用",[263,299,300],{},"外部 readiness 尚未获得证明",[235,302,304],{"id":303},"_1-接入前检查","1. 接入前检查",[214,306,307],{},[218,308,309],{},"状态：已开放（评估指南）；需要平台开通（商业与生产资格）。",[311,312,313,317,320,323],"ul",{},[314,315,316],"li",{},"确认场景是匿名目录读取、API Key 服务端读取，还是尚未开放的用户授权\u002F写入能力。",[314,318,319],{},"明确数据控制者、终端用户、店铺\u002F资源边界、市场与数据保留要求。",[314,321,322],{},"指定技术负责人、安全联系人和应急联系人；建立凭据泄漏、限流和未知写入结果的响应流程。",[314,324,325,326,329],{},"只把 ",[231,327,328],{"href":89},"20 项已开放操作"," 纳入当前实施范围。",[214,331,332,335],{},[218,333,334],{},"继续条件："," 所需能力均有公开 Reference，或平台书面确认开通路径。否则停止集成，不从控制台流量或混合 OpenAPI 推测接口。",[235,337,339],{"id":338},"_2-申请应用与环境","2. 申请应用与环境",[214,341,342],{},[218,343,344],{},"状态：需要平台开通。",[214,346,347],{},"应用、环境、API Key、installation、生产资格及相关能力由 Ayalink 平台配置或审批；当前没有公开的申请\u002F管理 endpoint。向平台提供应用名称、业务场景、所需市场、回调域名、技术与安全联系人，以及最小权限说明。秘密只通过平台批准的安全交付方式接收。",[214,349,350,352],{},[218,351,334],{}," 已获得目标环境的明确标识、允许能力、凭据交付与轮换说明。文档页面、client ID 或 CORS 成功都不代表生产资格。",[235,354,356],{"id":355},"_3-官方授权域与-pkce","3. 官方授权域与 PKCE",[214,358,359],{},[218,360,361],{},"状态：尚未开放（OAuth endpoint）；安全模型已公开。",[214,363,364,365,225,369,372],{},"需要用户授权时，只能把用户送往平台开通材料确认的官方 Ayalink authorization domain，并使用 Authorization Code + PKCE S256、精确 redirect URI、逐次生成并校验的 ",[366,367,368],"code",{},"state",[366,370,371],{},"nonce","。第三方不得反代或仿冒登录页，也不得收集密码\u002FMFA。",[214,374,375,376,379],{},"当前 public-only artifact 不包含 authorization、token exchange、撤销或 grant 管理 endpoint，并明确阻塞于 DPoP 与 resource\u002Finstallation 绑定，因此本站不提供 URL、scope、curl 或成功响应。详见 ",[231,377,378],{"href":48},"OAuth 与账号安全边界","。",[214,381,382,385],{},[218,383,384],{},"停止条件："," 未获得平台确认的官方域、client 配置或精确 redirect URI 时，不实现 OAuth 跳转或 token exchange。",[235,387,389],{"id":388},"_4-token-安全与-bff","4. Token 安全与 BFF",[214,391,392],{},[218,393,394],{},"状态：已开放（安全架构指南）；需要平台开通（真实 grant）；尚未开放（DPoP、rotation 等未确认能力）。",[214,396,397,398,221,401,404,405,408],{},"浏览器不得持有 client secret，不得把 access\u002Frefresh token 放入 URL、持久化浏览器存储、日志、分析或错误报告。需要浏览器会话时使用同源 BFF：BFF 仅保存该应用自己的 grant，并向自己的前端签发 ",[366,399,400],{},"HttpOnly",[366,402,403],{},"Secure","、适当 ",[366,406,407],{},"SameSite"," 的应用会话 Cookie；绝不接收或转发 Ayalink 全局 Cookie。",[214,410,411],{},"按平台开通材料确认 token audience、资源边界、有效期、轮换和撤销语义。未公开的 DPoP、refresh-token rotation 与 replay detection 不能当作现有能力。",[235,413,415],{"id":414},"_5-调用已开放-api","5. 调用已开放 API",[214,417,418],{},[218,419,420],{},"状态：已开放（20 项只读操作）。",[214,422,423],{},"当前 Reference 包含 7 项匿名 catalog 读取与 4 项 API Key identity\u002Fcatalog 读取。按每个 operation 页面使用真实 method、path、认证、参数与响应 schema；不要从本指南复制或猜测 Base URL，运行环境地址以平台开通材料为准。",[311,425,426,431,434],{},[314,427,428],{},[231,429,430],{"href":89},"浏览已开放 API 目录",[314,432,433],{},"API Key 只放服务端批准的 header，禁止进入浏览器 bundle 或 URL。",[314,435,436],{},"请求只发送 Reference 声明的参数；没有 schema 的示例不自行补造。",[214,438,439,441],{},[218,440,334],{}," 目标 operation 存在于当前目录，且所需认证已开通。Installation identity\u002Freadiness 读取已开放；写操作、OAuth、installation 写入与 Webhook 管理不在这 20 项中。",[235,443,445],{"id":444},"_6-分页错误requestid-与-429","6. 分页、错误、requestId 与 429",[214,447,448],{},[218,449,450],{},"状态：已开放（以每个 operation 的公开契约为准）。",[214,452,453,454,221,457,221,460,463,464,467],{},"分页参数、游标与响应结构只按对应 operation 页面声明实现；若 spec 未声明，则不能假设 ",[366,455,456],{},"page",[366,458,459],{},"limit",[366,461,462],{},"cursor"," 或总数。按 HTTP 状态与稳定错误码分支处理，不解析自然语言文案。保存响应中实际提供的 ",[366,465,466],{},"requestId"," 或关联编号，用于支持与对账；具体字段\u002Fheader 未声明时以平台材料为准，不自行创造。",[214,469,470,471,474,475,478,479,221,482,221,485,221,488,221,491,221,494,225,496,499,500,379],{},"收到 ",[366,472,473],{},"429"," 时，仅当响应实际提供 ",[366,476,477],{},"Retry-After"," 才按其等待；否则使用有界指数退避与抖动，并限制重试预算。",[366,480,481],{},"401",[366,483,484],{},"403",[366,486,487],{},"404",[366,489,490],{},"409\u002F412",[366,492,493],{},"422",[366,495,473],{},[366,497,498],{},"5xx"," 的恢复边界见",[231,501,92],{"href":93},[235,503,505],{"id":504},"_7-幂等与未知结果","7. 幂等与未知结果",[214,507,508],{},[218,509,510],{},"状态：已开放操作均为 GET，不需要写入幂等键；installation 写入与订单 API 尚未开放。",[214,512,513],{},"对当前 20 项读取操作可进行有界安全重试，但仍须遵守限流。未来写操作只有在新的 public-only artifact 明确给出幂等要求、key 位置、冲突和查询语义后才能接入。超时或断连后的写入结果必须视为未知，先查询\u002F对账，再决定下一步，不能盲目重放。",[235,515,517],{"id":516},"_8-webhook-签名重放与重试","8. Webhook 签名、重放与重试",[214,519,520],{},[218,521,522],{},"状态：需要平台开通（订阅与 secret）；尚未开放（订阅管理 endpoint 仍缺 installation-bound credential）；验签与恢复指南已公开。",[214,524,525],{},"接收方必须基于原始请求体、平台声明的 timestamp 与签名材料完成 HMAC 校验，使用常量时间比较、时间窗校验和 event ID 原子去重；签名通过前不解析 JSON。轮换时只接受平台明确允许的当前\u002F前一 key 窗口。",[214,527,528,529,531,532,535,536,379],{},"发送方重试次数、时间窗、header 名称和 dead-letter 行为以平台开通材料为准。本地处理应有界退避、尊重实际收到的 ",[366,530,477],{},"、保留原 event ID，并让业务效果幂等。详见 ",[231,533,534],{"href":72},"Webhook 指南"," 与",[231,537,538],{"href":192},"验签示例",[235,540,542],{"id":541},"_9-测试与验收","9. 测试与验收",[214,544,545],{},[218,546,547],{},"状态：已开放（静态契约测试）；需要平台开通（真实环境联调）。",[214,549,550],{},"至少覆盖：成功读取、空结果、无效\u002F撤销凭据、权限拒绝、资源不存在、校验错误、429、5xx\u002F断连、分页边界、日志脱敏；若接入 Webhook，再覆盖错误签名、过期 timestamp、重复 event、乱序、重试和 secret 轮换。测试不得使用生产 secret 或真实个人数据。",[214,552,553,555],{},[218,554,334],{}," 合同测试使用当前 artifact，真实环境联调记录 requestId、时间、operationId 与脱敏结果；所有未知结果均能对账或安全停止。",[235,557,559],{"id":558},"_10-生产上线检查","10. 生产上线检查",[214,561,562],{},[218,563,564],{},"状态：需要平台开通；外部 readiness 尚未获得证明。",[311,566,567,570,573,576,583],{},[314,568,569],{},"平台已确认生产应用\u002F环境、允许能力、市场和凭据状态。",[314,571,572],{},"Base URL、authorization domain、redirect URI、audience、scope 与 Webhook 参数均来自平台材料，而非文档推测。",[314,574,575],{},"凭据进入 secret manager；日志、监控、告警、轮换、限流预算和应急联系人已就绪。",[314,577,578,579,582],{},"生产前重新核对当前 ",[231,580,581],{"href":89},"API Reference"," 的来源版本与变更说明。",[314,584,585],{},"灰度、回滚和停止条件有负责人；不得把测试环境成功当作生产批准。",[235,587,589],{"id":588},"_11-撤销与应急","11. 撤销与应急",[214,591,592],{},[218,593,594],{},"状态：需要平台开通（撤销入口与支持）；安全响应流程已开放。",[214,596,597],{},"发现 token\u002FAPI Key\u002FWebhook secret 泄漏、异常调用、仿冒授权页或越权迹象时：立即停止相关流量，隔离泄漏来源，通过平台批准入口撤销或轮换受影响凭据，保留 requestId、operationId、时间窗和脱敏日志，并联系官方安全渠道。不要把 token、Cookie 或完整 payload 发进工单。",[214,599,600],{},"重新上线前确认旧凭据确已失效、消费者已更新、重复事件\u002F未知写入已对账、根因已修复，并重新执行生产检查。当前未公开自助撤销 endpoint；不得猜测 URL 或把删除本地 Cookie 当作撤销 grant。",[235,602,604],{"id":603},"reference-自动扩充原则","Reference 自动扩充原则",[214,606,607],{},"后续 API public-only artifact 到达时，importer 会校验来源 commit、hash、operationId、安全方案和内部边界，再自动生成新增双语 endpoint 页面。本指南只据真实 artifact 更新开放状态；不会等待“全量接口”，也不会手写不存在的 endpoint、scope 或响应。",{"title":609,"searchDepth":610,"depth":610,"links":611},"",2,[612,613,614,615,616,617,618,619,620,621,622,623,624],{"id":237,"depth":610,"text":237},{"id":303,"depth":610,"text":304},{"id":338,"depth":610,"text":339},{"id":355,"depth":610,"text":356},{"id":388,"depth":610,"text":389},{"id":414,"depth":610,"text":415},{"id":444,"depth":610,"text":445},{"id":504,"depth":610,"text":505},{"id":516,"depth":610,"text":517},{"id":541,"depth":610,"text":542},{"id":558,"depth":610,"text":559},{"id":588,"depth":610,"text":589},{"id":603,"depth":610,"text":604},"从接入评估、平台开通和安全授权，到 API、Webhook、测试、生产上线与应急撤销的完整路径。","md",null,{},true,{"title":18,"description":625},"OulC6Z_7R7ODdm9vmh0HC-mDO6SNE2eX33rZdHITOUs",[633,635],{"title":14,"path":15,"stem":16,"description":634,"children":-1},"理解公开文档、平台、店铺、安装、用户与 Provider 的信任边界。",{"title":29,"path":30,"stem":31,"description":636,"children":-1},"在保持 Ayalink 身份、页面准入、缓存和挑战边界的前提下构建独立商城。",1785955320532]