Skip to content
Log inStart free

API reference

Store API

Everything inside one store: products, orders, customers, inventory, shipping, taxes and the storefront cart and checkout. 1,335 operations in 146 groups, on one host for every store and region.

Make your first callTry it in the workbench
Store APIOpenAPI 3.0.0 · v2.0api.tanqory.com
Operations
1,335
Groups
146
Schemas
404

Largest groups

  1. Orders92 operations
  2. Analytics57 operations
  3. Taxes48 operations
  4. Store Taxes34 operations
  5. Customers33 operations
  6. Transfers30 operations

Client libraries

Call it from the stack you know

Every operation is an HTTPS request with a JSON body, so any language can call the Store API. In TypeScript, the SDK wraps the same OpenAPI documents.

  • TypeScript SDK@tanqory/sdk, generated from the OpenAPI documents this reference is built from, for browsers and Node.js.
  • React and React NativeThe @tanqory/sdk/react and @tanqory/sdk/react-native entry points add hooks for web and mobile apps.
  • Any HTTP clientcURL, fetch or Python requests: send the Bearer header and a JSON body, read JSON back.
  • Python and GoLibraries are on the roadmap. Until they ship, call the API over HTTPS as shown below.
install.sh
npm install @tanqory/sdk# Entry points#   @tanqory/sdk               browsers and Node.js#   @tanqory/sdk/react         React hooks#   @tanqory/sdk/react-native  React Native

Authentication

One Bearer token per request

Every Store API call carries an Authorization header with a JSON Web Token. The same token opens the Admin, Store and AI APIs, so one key serves your whole app.

  • Bearer tokenThe spec declares one security scheme: HTTP bearer, format JWT, on every operation that needs sign-in.
  • Keep keys on the serverAnyone holding a key acts as you. Never commit it, log it or ship it in a browser bundle.
  • API License and TermsHow keys may be used and rotated.
  • When a token failsA missing, wrong or expired token answers 401 with the code auth_token_invalid. Sign in again; never retry the same token.
request.http
GET /api/v1/stores/{storeId}/products HTTP/1.1Host: api.tanqory.comAuthorization: Bearer $TANQORY_API_KEYContent-Type: application/json
401.json401 Unauthorized
{  "error": {    "type": "authentication_error",    "code": "auth_token_invalid",    "status": 401  }}

Base URL

Where the Store API answers

Each store runs in the cloud region chosen when it was created, and its data stays there. The Store API still answers on one host: a call names the store in its path, and the platform routes it to that store's region.

  • One hosthttps://api.tanqory.com serves every store in every region; https://api.tanqory.dev is the development host.
  • The store in the pathStore calls run under /api/v1/stores/{storeId}/..., so the store ID decides where the call is answered.
  • One contractPaths, bodies and the Bearer token are identical in every region.
  • Productionhttps://api.tanqory.com
  • Developmenthttps://api.tanqory.dev

How a call is addressed

  1. https://api.tanqory.comOne host, whatever region the store runs in.
  2. /api/v1/stores/{storeId}/productsA store-scoped path names the store whose data answers.
  3. Authorization: Bearer $TANQORY_API_KEYThe same token as the Admin and AI APIs.

First call

Make a call

The same request in three languages. Export your key as TANQORY_API_KEY and your store's id as STORE_ID, then run it.

  • GET /api/v1/stores/{storeId}/productsList all products. Find the operation in the Products group, with its parameters and responses.
  • ResponsesIt answers 200 OK; a failure returns the one error object every call shares.
  • WorkbenchFill the fields and send the same request from the browser.
list-products.sh200 OK
HOST=https://api.tanqory.comcurl -H "Authorization: Bearer $TANQORY_API_KEY" \  "$HOST/api/v1/stores/$STORE_ID/products"
GET/api/v1/stores/{storeId}/products

List all products

Parameters

  • storeIdstring · pathrequired

Responses

  • 200OKProducts retrieved successfully

Limits, errors and versions

Rules every call shares

Retry what is safe to retry, read the one error envelope, and pin the version in the path.

  • Rate limitsTreat 429 and 503 as a signal to wait: honor Retry-After, otherwise back off with jitter, at most 4 attempts.
  • ErrorsEvery error is one error object with a type, a code, the status and a request id; a validation error lists each field.
  • VersioningVersions live in the URL path, not in a header. The Store API is on /api/v1, document version 2.0.
  • PaginationList operations that page declare limit with offset or page; each operation's parameters say which.
with-retry.js
// Retry 429 and 503: honor Retry-After, else back off with jitter.async function withRetry(fn, max = 4) {  for (let attempt = 0; ; attempt++) {    const res = await fn();    if (res.status !== 429 && res.status !== 503) return res;    if (attempt >= max) return res;    const retryAfter = Number(res.headers.get('Retry-After'));    const base = Number.isFinite(retryAfter)      ? retryAfter * 1000      : Math.min(1000 * 2 ** attempt, 30_000); // 1s, 2s, 4s, capped    await new Promise((r) => setTimeout(r, base + Math.random() * 250));  }}

Every group

Browse the Store API

Each group opens its operations with their parameters, request bodies and responses, straight from the spec.

404 schemasWebhooks

Store API1,335 operations, 146 groups

Make your first call today

Open a store, create a key and list your stores in one request. AI is part of every plan.

  • One Bearer token for every API
  • Generated from the OpenAPI spec
  • SDK, CLI and MCP server
Start buildingRead the quickstart

We use cookies

Necessary cookies keep the site working. With your permission we also use analytics and marketing cookies. Change your choice any time in Cookie settings.