API reference

Embedded Storefront Content API

Read published pages, templates, support, products and bundle ownership previews.

Start with getting started Explore API docs

Load published content for an allowed site

Pages, templates, product detail, support, reviews and bundles use /api/embed/storefront/{storeSlug}. The embed origin must be allowed and the storefront must be published. A rejected origin can record an installation check; these calls are not guaranteed zero-write health probes.

GET pages combines published stored pages with permitted generated defaults. An explicitly unpublished page stays hidden. Page/template endpoints return structured definitions and selections, not arbitrary rendered HTML. Use the existing bootstrap/config and frame-token workflow for embedding the experience.

Treat ownership pricing as a preview

A bundle price-check can use a customer library Bearer token. Valid identity enables the supported owned-product lookup; an invalid token is treated as unauthenticated. The response separates ownedItems, missingItems, discounts and checkout hints. Subscription plans return their recurring price rather than an existing-owner discount.

customer/ownership must include a bundle slug for validated ownership pricing. Without it the compatibility response only reports whether a token string was supplied; that boolean is not authentication. Never grant access from it. Checkout recalculates pricing and eligibility, including the $9.99 paid minimum; a preview is not a charge, entitlement or guaranteed accepted offer.

Use the supported customer login

The embedded auth/request-code and auth/verify-code handlers return 501 MAGIC_CODE_LOGIN_NOT_CONFIGURED. They are not available magic-code login APIs. Use the hosted customer account login and supported library-token flow. Keep tokens out of public links and logs.

The embed checkout compatibility handler returns 409 USE_PRODUCT_CHECKOUT_ENDPOINT. Use /api/checkout/product for server-calculated checkout. Client cart display and a coupon preview do not authorize payment or access.

Newsletter confirmation changes subscription state

The hosted newsletter verification link returns HTML and consumes the private token. Do not poll it as a health check or share it as an example URL. This confirmation is separate from customer login, purchase audience enrollment, and unsubscribe/suppression controls.

SoundSync

Integration references

Embed API

Bootstrap, frames, cart and customer library.

Explore

Checkout API

Server-calculated payment requests.

Explore

Account API

Customer sign-in and verification.

Explore

SoundSync

Requests and responses

GET /api/embed/storefront/{storeSlug}/pages

List published pages and generated system defaults

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, pages.
Notes: Origin denial can record an installation-check event. Explicit unpublished stored pages remain hidden; a generated default does not bypass an explicit unpublished page.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "customDomain": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    },
    "pages": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "pageType": {
            "type": "string"
          },
          "pageSlug": {
            "type": "string"
          },
          "templateKey": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "selectedTemplate": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          },
          "availableTemplates": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": true,
              "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
            }
          },
          "publishingTargets": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          },
          "content": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/templates

Read page template selections and registry

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, registry, pages.
Notes: Origin denial can record an installation-check event.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "customDomain": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    },
    "registry": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "pages": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "pageType": {
            "type": "string"
          },
          "pageSlug": {
            "type": "string"
          },
          "templateKey": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "selectedTemplate": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          },
          "availableTemplates": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": true,
              "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
            }
          },
          "publishingTargets": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          },
          "content": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/pages/{pageType}

Read one published page definition

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, page.
Notes: Origin denial can record an installation-check event. Unsupported page types return 400; explicitly unpublished pages return 404. Page definitions are structured data, not arbitrary website HTML.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "customDomain": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    },
    "page": {
      "type": "object",
      "properties": {
        "pageType": {
          "type": "string"
        },
        "pageSlug": {
          "type": "string"
        },
        "templateKey": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "selectedTemplate": {
          "type": "object",
          "additionalProperties": true,
          "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
        },
        "availableTemplates": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "publishingTargets": {
          "type": "object",
          "additionalProperties": true,
          "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
        },
        "content": {
          "type": "object",
          "additionalProperties": true,
          "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/templates/{pageType}

Read one page template selection

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, pageType, pageSlug, templateKey, status, selectedTemplate, availableTemplates, publishingTargets, content.
Notes: Origin denial can record an installation-check event.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "customDomain": {
          "type": [
            "string",
            "null"
          ]
        }
      },
      "additionalProperties": true
    },
    "pageType": {
      "type": "string"
    },
    "pageSlug": {
      "type": "string"
    },
    "templateKey": {
      "type": "string"
    },
    "status": {
      "type": "string"
    },
    "selectedTemplate": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "availableTemplates": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    },
    "publishingTargets": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "content": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/products/{productSlug}

Read public product detail and reviews

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, product, reviews.
Notes: Origin denial can record an installation-check event.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "product": {
      "type": "object",
      "properties": {
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "name": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "slug": {
          "type": [
            "string",
            "null"
          ]
        },
        "description": {
          "type": [
            "string",
            "null"
          ]
        },
        "shortDescription": {
          "type": [
            "string",
            "null"
          ]
        },
        "price": {
          "type": "number"
        },
        "salePrice": {
          "type": [
            "number",
            "null"
          ]
        },
        "regularPrice": {
          "type": "number"
        },
        "displayPrice": {
          "type": "number"
        },
        "priceDisplay": {
          "type": "string"
        },
        "regularPriceDisplay": {
          "type": "string"
        },
        "salePriceDisplay": {
          "type": [
            "string",
            "null"
          ]
        },
        "isOnSale": {
          "type": "boolean"
        },
        "currency": {
          "type": "string"
        },
        "imageUrl": {
          "type": [
            "string",
            "null"
          ]
        },
        "coverImage": {
          "type": [
            "string",
            "null"
          ]
        },
        "developerId": {
          "type": "integer",
          "minimum": 1
        },
        "developerName": {
          "type": "string"
        },
        "developer": {
          "type": [
            "object",
            "null"
          ],
          "properties": {
            "id": {
              "type": "integer",
              "minimum": 1
            },
            "name": {
              "type": "string"
            },
            "slug": {
              "type": [
                "string",
                "null"
              ]
            },
            "profileUrl": {
              "type": [
                "string",
                "null"
              ]
            },
            "verified": {
              "type": "boolean"
            }
          },
          "additionalProperties": true
        },
        "productType": {
          "type": "string"
        },
        "productTypes": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "categories": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "tags": {
          "type": "array",
          "items": {
            "type": "string"
          }
        },
        "url": {
          "type": "string"
        },
        "subscriptionEnabled": {
          "type": "boolean"
        },
        "billingInterval": {
          "type": [
            "string",
            "null"
          ]
        },
        "checkoutEligible": {
          "type": "boolean"
        },
        "capabilities": {
          "type": "object",
          "additionalProperties": true,
          "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
        },
        "requiresActivation": {
          "type": "boolean"
        },
        "supportsSerials": {
          "type": "boolean"
        },
        "supportsDownloads": {
          "type": "boolean"
        },
        "marketplaceAsset": {
          "type": [
            "object",
            "null"
          ],
          "additionalProperties": true,
          "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
        }
      },
      "additionalProperties": true
    },
    "reviews": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/support

Read published storefront support content

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, support, articles, aiAssistant, contactForm.
Notes: Origin denial can record an installation-check event.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "support": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "articles": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    },
    "aiAssistant": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "contactForm": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/reviews

Read published storefront reviews

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Request fields: query limit: integer
query page: integer
query search: string
query rating: string
Returns: HTTP 200: storefront, reviews, summary, eligibleProducts.
Notes: Origin denial can record an installation-check event. page selects the paginated reviews workflow; without page, summary describes the returned limited review set. This embed handler does not resolve a token into eligibleProducts. Use the authenticated review/account flow for posting; public reviews are not proof of every purchaser being verified.

Request, response and error reference

Query and header parameters

[
  {
    "name": "limit",
    "in": "query",
    "schema": {
      "type": "integer",
      "minimum": 1
    },
    "required": false,
    "description": ""
  },
  {
    "name": "page",
    "in": "query",
    "schema": {
      "type": "integer",
      "minimum": 1
    },
    "required": false,
    "description": ""
  },
  {
    "name": "search",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  },
  {
    "name": "rating",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  }
]

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    },
    "reviews": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    },
    "summary": {
      "type": "object",
      "properties": {
        "count": {
          "type": "integer"
        },
        "averageRating": {
          "type": "number"
        }
      },
      "additionalProperties": true
    },
    "eligibleProducts": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/bundles

List active bundle offers and published subscription plans

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, bundles.
Notes: Origin denial can record an installation-check event.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "slug": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "bundles": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "kind": {
            "type": "string"
          },
          "id": {
            "type": "integer",
            "minimum": 1
          },
          "slug": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "offerType": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "discountType": {
            "type": "string"
          },
          "discountValue": {
            "type": "number"
          },
          "productIds": {
            "type": "array",
            "items": {
              "type": "integer",
              "minimum": 1
            }
          },
          "subscriptionProductIds": {
            "type": "array",
            "items": {
              "type": "integer",
              "minimum": 1
            }
          },
          "products": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": true,
              "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
            }
          },
          "checkoutBacked": {
            "type": "boolean"
          },
          "recurringAmountCents": {
            "type": "integer"
          },
          "currency": {
            "type": "string"
          }
        },
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/bundles/{bundleSlug}

Read an active storefront bundle

Auth: Allowed embed origin/domain; see the frame and operation notes
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: storefront, bundle.
Notes: Origin denial can record an installation-check event.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "slug": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "bundle": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string"
        },
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "offerType": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "discountType": {
          "type": "string"
        },
        "discountValue": {
          "type": "number"
        },
        "productIds": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 1
          }
        },
        "subscriptionProductIds": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 1
          }
        },
        "products": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "checkoutBacked": {
          "type": "boolean"
        },
        "recurringAmountCents": {
          "type": "integer"
        },
        "currency": {
          "type": "string"
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

POST /api/embed/storefront/{storeSlug}/bundles/{bundleSlug}/price-check

Preview bundle ownership pricing

Auth: Optional authentication OR Customer library/download token
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Returns: HTTP 200: bundle, customerAuthenticated, fullPriceCents, ownedValueCents, missingSubtotalCents, eligibleDiscountCents, upgradePriceCents, finalCheckoutTotalCents, currency, ownedItems, missingItems, checkout.
Notes: Origin denial can record an installation-check event. Optional Bearer library token is resolved by the server; invalid/expired tokens are treated as unauthenticated. Prefer the header, not URL query tokens. This is a price/ownership preview, not a charge or new entitlement. Checkout recalculates final eligibility/pricing. Subscription plans return recurring price with no existing-owner discount.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "bundle": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string"
        },
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "offerType": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "discountType": {
          "type": "string"
        },
        "discountValue": {
          "type": "number"
        },
        "productIds": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 1
          }
        },
        "subscriptionProductIds": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 1
          }
        },
        "products": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "checkoutBacked": {
          "type": "boolean"
        },
        "recurringAmountCents": {
          "type": "integer"
        },
        "currency": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "customerAuthenticated": {
      "type": "boolean"
    },
    "fullPriceCents": {
      "type": "integer"
    },
    "ownedValueCents": {
      "type": "integer"
    },
    "missingSubtotalCents": {
      "type": "integer"
    },
    "eligibleDiscountCents": {
      "type": "integer"
    },
    "upgradePriceCents": {
      "type": "integer"
    },
    "finalCheckoutTotalCents": {
      "type": "integer"
    },
    "currency": {
      "type": "string"
    },
    "ownedItems": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    },
    "missingItems": {
      "type": "array",
      "items": {
        "type": "object",
        "additionalProperties": true,
        "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
      }
    },
    "checkout": {
      "type": "object",
      "additionalProperties": true,
      "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 403, 404, 500.

GET /api/embed/storefront/{storeSlug}/customer/ownership

Preview bundle ownership for a customer

Auth: Optional authentication OR Customer library/download token
Scope: Published storefront and allowed embed origin; origin checks are not customer authentication.
Request fields: query bundle: string
query bundleSlug: string
query bundle_slug: string
Returns: HTTP 200: review the response schema below.
Notes: Origin denial can record an installation-check event. Optional Bearer library token is resolved by the server; invalid/expired tokens are treated as unauthenticated. Prefer the header, not URL query tokens. This is a price/ownership preview, not a charge or new entitlement. Checkout recalculates final eligibility/pricing. Subscription plans return recurring price with no existing-owner discount. Without a bundle slug, customerAuthenticated only indicates token presence, not validated identity; ownedItems/missingItems are empty. Never grant access based on that presence flag.

Request, response and error reference

Query and header parameters

[
  {
    "name": "bundle",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  },
  {
    "name": "bundleSlug",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  },
  {
    "name": "bundle_slug",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": false,
    "description": ""
  }
]

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "anyOf": [
    {
      "type": "object",
      "properties": {
        "bundle": {
          "type": "object",
          "properties": {
            "kind": {
              "type": "string"
            },
            "id": {
              "type": "integer",
              "minimum": 1
            },
            "slug": {
              "type": "string"
            },
            "name": {
              "type": "string"
            },
            "title": {
              "type": "string"
            },
            "offerType": {
              "type": "string"
            },
            "status": {
              "type": "string"
            },
            "discountType": {
              "type": "string"
            },
            "discountValue": {
              "type": "number"
            },
            "productIds": {
              "type": "array",
              "items": {
                "type": "integer",
                "minimum": 1
              }
            },
            "subscriptionProductIds": {
              "type": "array",
              "items": {
                "type": "integer",
                "minimum": 1
              }
            },
            "products": {
              "type": "array",
              "items": {
                "type": "object",
                "additionalProperties": true,
                "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
              }
            },
            "checkoutBacked": {
              "type": "boolean"
            },
            "recurringAmountCents": {
              "type": "integer"
            },
            "currency": {
              "type": "string"
            }
          },
          "additionalProperties": true
        },
        "customerAuthenticated": {
          "type": "boolean"
        },
        "fullPriceCents": {
          "type": "integer"
        },
        "ownedValueCents": {
          "type": "integer"
        },
        "missingSubtotalCents": {
          "type": "integer"
        },
        "eligibleDiscountCents": {
          "type": "integer"
        },
        "upgradePriceCents": {
          "type": "integer"
        },
        "finalCheckoutTotalCents": {
          "type": "integer"
        },
        "currency": {
          "type": "string"
        },
        "ownedItems": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "missingItems": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "checkout": {
          "type": "object",
          "additionalProperties": true,
          "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
        }
      },
      "additionalProperties": true
    },
    {
      "type": "object",
      "properties": {
        "customerAuthenticated": {
          "type": "boolean"
        },
        "ownedItems": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "missingItems": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "message": {
          "type": "string"
        }
      },
      "additionalProperties": true
    }
  ]
}

Documented failures: 400, 403, 404, 500.

GET /api/storefronts/{slug}/bundles

List public hosted bundle offers

Auth: Public request; operation-specific verification still applies
Scope: Published storefront and public offer visibility.
Returns: HTTP 200: storefront, bundles.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "slug": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "bundles": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "kind": {
            "type": "string"
          },
          "id": {
            "type": "integer",
            "minimum": 1
          },
          "slug": {
            "type": "string"
          },
          "name": {
            "type": "string"
          },
          "title": {
            "type": "string"
          },
          "offerType": {
            "type": "string"
          },
          "status": {
            "type": "string"
          },
          "discountType": {
            "type": "string"
          },
          "discountValue": {
            "type": "number"
          },
          "productIds": {
            "type": "array",
            "items": {
              "type": "integer",
              "minimum": 1
            }
          },
          "subscriptionProductIds": {
            "type": "array",
            "items": {
              "type": "integer",
              "minimum": 1
            }
          },
          "products": {
            "type": "array",
            "items": {
              "type": "object",
              "additionalProperties": true,
              "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
            }
          },
          "checkoutBacked": {
            "type": "boolean"
          },
          "recurringAmountCents": {
            "type": "integer"
          },
          "currency": {
            "type": "string"
          }
        },
        "additionalProperties": true
      }
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 404, 500.

GET /api/storefronts/{slug}/bundles/{bundleSlug}

Read a hosted bundle offer

Auth: Public request; operation-specific verification still applies
Scope: Published storefront and public offer visibility.
Returns: HTTP 200: storefront, bundle.

Request, response and error reference

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "storefront": {
      "type": "object",
      "properties": {
        "slug": {
          "type": "string"
        }
      },
      "additionalProperties": true
    },
    "bundle": {
      "type": "object",
      "properties": {
        "kind": {
          "type": "string"
        },
        "id": {
          "type": "integer",
          "minimum": 1
        },
        "slug": {
          "type": "string"
        },
        "name": {
          "type": "string"
        },
        "title": {
          "type": "string"
        },
        "offerType": {
          "type": "string"
        },
        "status": {
          "type": "string"
        },
        "discountType": {
          "type": "string"
        },
        "discountValue": {
          "type": "number"
        },
        "productIds": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 1
          }
        },
        "subscriptionProductIds": {
          "type": "array",
          "items": {
            "type": "integer",
            "minimum": 1
          }
        },
        "products": {
          "type": "array",
          "items": {
            "type": "object",
            "additionalProperties": true,
            "description": "Operation-specific extension data; do not put credentials or unnecessary personal information here."
          }
        },
        "checkoutBacked": {
          "type": "boolean"
        },
        "recurringAmountCents": {
          "type": "integer"
        },
        "currency": {
          "type": "string"
        }
      },
      "additionalProperties": true
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 404, 500.

GET /api/storefronts/{slug}/products/{productSlug}/reviews

Read paginated reviews of included bundle products

Auth: Public request; operation-specific verification still applies
Scope: Public published bundle with visible included products.
Request fields: query page: integer
Returns: HTTP 200: reviews, summary, pagination, endpoint.
Notes: Bundle-only aggregate of published reviews for visible included products. A non-bundle without bundleReviews returns 404. The server clamps the requested page. verified reflects the stored entitlement association, not an independent endorsement or universal verification guarantee.

Request, response and error reference

Query and header parameters

[
  {
    "name": "page",
    "in": "query",
    "schema": {
      "type": "integer",
      "minimum": 1
    },
    "required": false,
    "description": ""
  }
]

No request body fields are read by this operation.

HTTP 200 response (application/json)

{
  "type": "object",
  "properties": {
    "reviews": {
      "type": "array",
      "items": {
        "type": "object",
        "properties": {
          "id": {
            "anyOf": [
              {
                "type": "integer",
                "minimum": 1
              },
              {
                "type": "string",
                "pattern": "^[1-9][0-9]*$"
              }
            ]
          },
          "productId": {
            "anyOf": [
              {
                "type": "integer",
                "minimum": 1
              },
              {
                "type": "string",
                "pattern": "^[1-9][0-9]*$"
              }
            ]
          },
          "productName": {
            "type": "string"
          },
          "rating": {
            "type": "number"
          },
          "title": {
            "type": "string"
          },
          "body": {
            "type": "string"
          },
          "customerName": {
            "type": "string"
          },
          "verified": {
            "type": "boolean"
          },
          "createdAt": {
            "type": [
              "string",
              "null"
            ],
            "format": "date-time"
          }
        },
        "additionalProperties": true
      }
    },
    "summary": {
      "type": "object",
      "properties": {
        "count": {
          "type": "integer"
        },
        "averageRating": {
          "type": "number"
        }
      },
      "additionalProperties": true
    },
    "pagination": {
      "type": "object",
      "properties": {
        "page": {
          "type": "integer"
        },
        "pageSize": {
          "type": "integer"
        },
        "total": {
          "type": "integer"
        },
        "totalPages": {
          "type": "integer"
        }
      },
      "additionalProperties": true
    },
    "endpoint": {
      "type": "string"
    }
  },
  "additionalProperties": true
}

Documented failures: 400, 404, 500.

GET /api/storefronts/{slug}/newsletter/verify

Confirm a newsletter subscription using the private link

Auth: Public request; operation-specific verification still applies
Scope: Private newsletter verification token; no account session required.
Request fields: query token: string (required)
Returns: HTTP 200: text/html.
Notes: Consumes the verification link and changes subscription state. Do not poll, health-check, log or share this URL. Returns HTML success/error, not a customer session. This newsletter confirmation is distinct from purchase-related audience enrollment and does not override suppressions.

Request, response and error reference

Query and header parameters

[
  {
    "name": "token",
    "in": "query",
    "schema": {
      "type": "string"
    },
    "required": true,
    "description": ""
  }
]

No request body fields are read by this operation.

HTTP 200 response (text/html)

{
  "type": "string"
}

Documented failures: 400, 410.