Information
- OpenAPI version:
3.1.1
Overview
CIQRA App API v1
Section titled “CIQRA App API v1”The operations an app installation token may call. Generated from the platform’s OpenAPI document; an operation appears here if and only if the API accepts app tokens on it.
Authentication
Section titled “ Authentication ”bearerAuth
Section titled “bearerAuth”Bearer token. Two issuers travel in this header and are distinguished server-side: an admin session token issued by CIQRA’s OpenIddict server (used by the admin BFF, which also sends X-Tenant derived from the token’s validated tenant_id claim), and an app installation token issued to an (app, tenant) installation via the OAuth2 client_credentials grant. An installation token carries its tenant: the tenant is resolved FROM the token and is never read from a parameter, a body field or a header the caller supplies.
Scopes (app installation tokens only). This platform publishes 52 scopes and currently enforces 9 of them at an endpoint. A scope in the not-yet-enforced list can be requested, granted and is reported back in the token response, and no endpoint consults it — it grants nothing today and is listed so that is a published fact rather than a discovery. The token response repeats the same answer per installation in scopeNotYetEnforced.
Enforced: write_media, write_metaobjects, write_blogs, write_products, read_products, read_collections, read_inventory, read_webhooks, write_webhooks.
Not yet enforced: write_collections, write_inventory, read_prices, write_prices, read_orders, write_orders, read_draft_orders, write_draft_orders, read_fulfillments, write_fulfillments, read_returns, write_returns, read_customers, write_customers, read_customer_pii, read_metaobjects, read_content, write_content, read_blogs, read_translations, write_translations, read_media, read_discounts, write_discounts, read_shipping, write_shipping, read_payments, read_forms, write_forms, read_support, write_support, read_loyalty, write_loyalty, read_reviews, write_reviews, read_themes, write_themes, read_sites, read_seo, write_seo, read_analytics, read_app_data, write_app_data.
Security scheme type: http
Bearer format: opaque