Skip to main content
The pages in this tab are generated from the OpenAPI specification. Each endpoint has an interactive “Try it” form.

​
Base URL

Locally: http://localhost:3000/api/v2. All routes are prefixed with /api/v2.

​
Authentication

An endpoint can require a bearerAuth session, a shop key through apiKeyAuth, accept either mechanism, or be public. For a key:
If an endpoint allows keys and both mechanisms are present, the key is checked. An ordinary Bearer route ignores the key and uses the session. Details: Authentication.

​
Response conventions

Success has the shape { success: true, data, message? }; an error { success: false, statusCode, error, timestamp, path }. Always check the success field. See Error handling.

​
Identifiers

Resource identifiers (shopId, serverId, orderId, …) are MongoDB ObjectIds — a 24-character hex string (^[0-9a-fA-F]{24}$). An invalid format returns 400.

​
Public endpoints

Some endpoints require no authentication: order creation, public catalogs, voucher redemption, discount-code validation, and payment webhooks. In the API reference they are marked as having no security.