REST API overview
The JSON API at /api/v1 - authentication, carts, orders, rate limits and where to find the full reference.
Sellora includes a JSON REST API under /api/v1 for building a mobile app, a headless storefront or integrations. The complete, interactive reference is part of your store:
https://your-domain.com/api/docs
It documents 50 operations with real example responses. The machine-readable OpenAPI 3.1 file is at https://your-domain.com/api-docs/openapi.json; import it into Postman, Insomnia or a code generator.
Switch it on#
Open Settings > API and enable the REST API. While disabled, every endpoint answers 503 with a JSON message. On the same page you can create and revoke access tokens.
Authentication#
- Guests can browse the catalogue, use a cart and check out without an account.
- Customers sign in with
POST /api/v1/auth/login(orregister) and receive a bearer token; send it asAuthorization: Bearer <token>.POST /api/v1/auth/logoutrevokes it.
Conventions#
- Responses are JSON. Errors look like
{ "message": "...", "errors": { ... } }with status 401, 403, 404, 422, 429 or 503. - Language and currency: send
Accept-Language: fr(or?lang=fr) andX-Currency: EUR(or?currency=EUR). The response carriesContent-LanguageandX-Currency. - Money is returned as
{ amount, formatted, currency }. - Rate limits: 60 requests per minute for guests (per IP), 120 per minute with a token; login, register, password reset, contact, newsletter and order tracking allow 10 per minute per IP. Exceeding it returns
429. - CORS headers are sent so browser apps can call it.
Guest carts#
A guest's cart is tied to the X-Cart-Token response header. Store it and send it back with every cart request. If the shopper signs in while sending that header, or you call POST /api/v1/cart/merge, the guest cart is merged into their account cart.
Endpoint groups#
| Group | Examples |
|---|---|
| Auth | POST auth/register, auth/login, auth/logout, auth/password/forgot; GET/PUT auth/me. |
| Bootstrap | GET bootstrap (settings, languages, currencies, menus), GET home. |
| Catalogue | GET categories, brands, products (with the same filters as the shop and facets=1), products/{slug}, products/{slug}/reviews, search/suggest, flash-sales/current. |
| Cart | GET cart, POST cart/items, PATCH/DELETE cart/items/{id}, POST/DELETE cart/coupon, POST cart/shipping-methods, POST cart/merge. |
| Checkout and orders | POST checkout, GET orders, GET orders/track, GET orders/{number}, POST orders/{number}/cancel, POST orders/{number}/pay. |
| Account | Addresses, wishlist, notifications, points and reviews. |
| Content | Pages, blog and contact. |
The checkout response contains data.order and data.payment whose type is completed, redirect (send the shopper to a URL), client (a client-side gateway such as Razorpay) or failed.
Limits of this version#
- Online-gateway payments over the API follow the same flow as the web store but were only verified at the web layer; test your payment flow in the sandbox - see Payments overview.
- Review image upload, newsletter third-party integrations and social login are not exposed through the API.
- Sorting by price uses the base price and ignores flash-sale and variation special prices, so order may differ slightly from displayed prices.
- The OpenAPI file is large (about 850 KB) because it contains inferred schemas and examples.