Skip to content

Sell

61 operations. Authenticate with your secret API key (see Authentication); failures use the shape described in Errors. Example requests read $GIEP_API_URL, your deployment’s API host.

Checkout sessions funnel, active-now count and recent activity

GET/v1/analytics/checkout-funnel

Counts of checkout sessions created in [from, to) (at most 400 days): with an email, with a payment attempt, paid; the previous period of equal length; sessions touched in the last 15 minutes; and the 10 most recent sessions without any customer data. Requires sell:read.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Query parameters

  • fromstring · date-timerequired

    ISO 8601 instant with Z or an offset, e.g. 2026-10-24T00:00:00Z

    pattern ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
  • tostring · date-timerequired

    ISO 8601 instant with Z or an offset, e.g. 2026-10-24T00:00:00Z

    pattern ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
  • storeIdstring · uuid

    A store of the merchant; omit for all of the merchant's stores

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.
200 response fieldsCheckoutFunnel
  • storeIdstringrequirednullable

    The store in scope; null = all stores.

  • fromstringrequired
  • tostringrequired
  • totalsobjectrequired
    Fields: 4 fields
    • createdintegerrequired

      Checkout sessions created in the window.

    • withEmailintegerrequired

      Sessions with an email captured.

    • withPaymentAttemptintegerrequired

      Sessions that started a payment.

    • paidintegerrequired

      Sessions with status paid.

  • ratesobjectrequired
    Fields: 4 fields
    • emailCapturednumberrequirednullable

      withEmail / created

      min 0 · max 1
    • paymentAttemptednumberrequirednullable

      withPaymentAttempt / created

      min 0 · max 1
    • paidOfAttemptednumberrequirednullable

      paid / withPaymentAttempt

      min 0 · max 1
    • paidOfCreatednumberrequirednullable

      paid / created

      min 0 · max 1
  • previousobjectrequired
    Fields: 4 fields
    • fromstringrequired
    • tostringrequired
    • totalsobjectrequired
      Fields: 4 fields
      • createdintegerrequired

        Checkout sessions created in the window.

      • withEmailintegerrequired

        Sessions with an email captured.

      • withPaymentAttemptintegerrequired

        Sessions that started a payment.

      • paidintegerrequired

        Sessions with status paid.

    • ratesobjectrequired
      Fields: 4 fields
      • emailCapturednumberrequirednullable

        withEmail / created

        min 0 · max 1
      • paymentAttemptednumberrequirednullable

        withPaymentAttempt / created

        min 0 · max 1
      • paidOfAttemptednumberrequirednullable

        paid / withPaymentAttempt

        min 0 · max 1
      • paidOfCreatednumberrequirednullable

        paid / created

        min 0 · max 1
  • activeNowobjectrequired
    Fields: 3 fields
    • countintegerrequired

      Open, unexpired sessions touched in the last window.

    • windowMinutesintegerrequired
    • asOfstringrequired
  • recentarray<object>required

    The 10 most recently created sessions. Contains no customer data.

    Each item has 8 fields
    • idstring · uuidrequired
    • checkoutNamestringrequired
    • statusstringrequired
    • totalintegerrequired

      Session total in minor units of currency.

    • currencystringrequired
      3 chars
    • sourcestringrequired
    • createdAtstringrequired
    • updatedAtstringrequired
Request · cURL
curl -X GET "$GIEP_API_URL/v1/analytics/checkout-funnel?from=1&to=1" \
  -H "Authorization: Bearer $GIEP_API_KEY"
{
  "storeId": "string",
  "from": "string",
  "to": "string",
  "totals": {
    "created": 1,
    "withEmail": 1,
    "withPaymentAttempt": 1,
    "paid": 1
  },
  "rates": {
    "emailCaptured": 1,
    "paymentAttempted": 1,
    "paidOfAttempted": 1,
    "paidOfCreated": 1
  },
  "previous": {
    "from": "string",
    "to": "string",
    "totals": {
      "created": 1,
      "withEmail": 1,
      "withPaymentAttempt": 1,
      "paid": 1
    },
    "rates": {
      "emailCaptured": 1,
      "paymentAttempted": 1,
      "paidOfAttempted": 1,
      "paidOfCreated": 1
    }
  },
  "activeNow": {
    "count": 1,
    "windowMinutes": 1,
    "asOf": "string"
  },
  "recent": [
    {
      "id": "37386ae0-251d-4f38-a753-611e841d7",
      "checkoutName": "string",
      "status": "string",
      "total": 4999,
      "currency": "USD",
      "source": "string",
      "createdAt": "2026-10-26T12:00:00.000Z",
      "updatedAt": "2026-10-26T12:00:00.000Z"
    }
  ]
}

Checkout funnel analytics

GET/v1/analytics/funnel

Checkout sessions created in the window and how many were paid. Prefer GET /v1/analytics/checkout-funnel, which adds rates, the previous period and recent activity.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Query parameters

  • fromany
  • toany

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/analytics/funnel" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Order bump and upsell performance

GET/v1/analytics/offers

Per offer in one currency, over paid sessions created in [from, to): sessions the offer was shown to, accepted, take rate and revenue (integer minor units). Requires sell:read.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Query parameters

  • fromstring · date-timerequired

    ISO 8601 instant with Z or an offset, e.g. 2026-10-24T00:00:00Z

    pattern ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
  • tostring · date-timerequired

    ISO 8601 instant with Z or an offset, e.g. 2026-10-24T00:00:00Z

    pattern ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|([+-](?:[01]\d|2[0-3]):[0-5]\d)))$
  • currencystring

    ISO 4217 code; defaults to the merchant's default currency

    pattern ^[A-Za-z]{3}$

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.
200 response fieldsOffersAnalytics
  • currencystringrequired
    3 chars
  • fromstringrequired
  • tostringrequired
  • offersarray<object>required
    Each item has 12 fields
    • offerIdstring · uuidrequired
    • checkoutIdstring · uuidrequired
    • checkoutNamestringrequired
    • titlestringrequired
    • kindstringrequired
      One ofbumpupsell
    • activebooleanrequired
    • amountintegerrequired

      The offer's current price (minor units).

    • currencystringrequired
      3 chars
    • offeredintegerrequired

      Paid sessions the offer was shown to.

    • acceptedintegerrequired
    • takeRatenumberrequirednullable

      accepted / offered

      min 0 · max 1
    • revenueintegerrequired

      Revenue from accepted offers (minor units).

  • totalsobjectrequired
    Fields: 3 fields
    • revenueintegerrequired
    • bumpRevenueintegerrequired
    • upsellRevenueintegerrequired
Request · cURL
curl -X GET "$GIEP_API_URL/v1/analytics/offers?from=1&to=1" \
  -H "Authorization: Bearer $GIEP_API_KEY"
{
  "currency": "USD",
  "from": "string",
  "to": "string",
  "offers": [
    {
      "offerId": "738b9848-20a7-4736-a22b-f187258aa",
      "checkoutId": "679010dc-dba5-41d2-a1d7-5b76-d95",
      "checkoutName": "string",
      "title": "string",
      "kind": "bump",
      "active": false,
      "amount": 4999,
      "currency": "USD",
      "offered": 1,
      "accepted": 1,
      "takeRate": 1,
      "revenue": 1
    }
  ],
  "totals": {
    "revenue": 1,
    "bumpRevenue": 1,
    "upsellRevenue": 1
  }
}

Captured carts (email + consent), newest first

GET/v1/carts

Status: started (open and active), abandoned (idle past CART_ABANDON_AFTER_MINUTES, expired or cancelled), recovered (paid after capture). Recovery emails are not part of v1.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Query parameters

  • statusstring
    One ofstartedabandonedrecovered
  • qstring
    max 200 chars
  • storeIdstring · uuid
  • limitinteger
    min 1 · max 100
  • beforeany

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/carts" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

One captured cart with the consent record

GET/v1/carts/{id}

One captured cart (email, items, value, status) with its consent record: mode, time and the version of the consent text shown.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/carts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Delete a captured cart (audited)

DELETE/v1/carts/{id}

Erases the shopper's personal data on an unpaid session (email, name, phone, address, notes, tracking ids; the customer record when no order uses it). A paid cart only leaves the list.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/carts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Export captured carts as CSV (audited)

GET/v1/carts/export.csv

CSV of the captured carts matching the filters. Contains shopper emails, so it needs sell:manage and is audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Query parameters

  • statusstring
    One ofstartedabandonedrecovered
  • qstring
    max 200 chars
  • storeIdstring · uuid
  • limitinteger
    min 1 · max 100
  • beforeany

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a CSV file, streamed.

200 response fields

Body type: string.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/carts/export.csv" \
  -H "Authorization: Bearer $GIEP_API_KEY"
(streamed CSV, one row per line)

List your saved checkout templates

GET/v1/checkout-templates

The merchant's own saved checkout templates (built-in templates are chosen with template on POST /v1/checkouts).

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/checkout-templates" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Save a checkout as a template for your stores

POST/v1/checkout-templates

Copies the checkout working copy with offer references cleared (offers belong to one checkout). Start a checkout from it with templateId on POST /v1/checkouts.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • checkoutIdstring · uuidrequired
  • namestringrequired
    min 1 chars · max 80 chars
  • descriptionstring
    max 300 chars

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/checkout-templates" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "checkoutId": "679010dc-dba5-41d2-a1d7-5b76-d95",
  "name": "string"
}'
// JSON object. The OpenAPI document does not list its fields.

Archive a saved template

DELETE/v1/checkout-templates/{id}

Archives a saved template. Checkouts already created from it are not changed.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/checkout-templates/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

List checkouts

GET/v1/checkouts

Checkouts of the merchant with status (draft, published, archived) and the published version.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/checkouts" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Create a checkout

POST/v1/checkouts

Creates a checkout (a draft) for a store, from a built-in template (dtc, subscription, high-risk), a saved templateId or an explicit config. Nothing is live until it is published.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • namestringrequired
    min 1 chars · max 200 chars
  • storeIdstring · uuid
  • templatestring
    One ofdtcsubscriptionhigh_riskblank
  • templateIdstring · uuid
  • slugstring
    pattern ^[a-z0-9][a-z0-9-]{2,58}[a-z0-9]$
  • configany

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/checkouts" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'
// JSON object. The OpenAPI document does not list its fields.

Retrieve a checkout

GET/v1/checkouts/{id}

One checkout with its working copy (draft config).

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/checkouts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Update a checkout

PATCH/v1/checkouts/{id}

Renames a checkout or replaces its working copy (draft config). The hosted page keeps serving the last published version until the next publish.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Request body · application/jsonrequired

  • namestring
    min 1 chars · max 200 chars
  • configany

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PATCH "$GIEP_API_URL/v1/checkouts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'
// JSON object. The OpenAPI document does not list its fields.

Archive a checkout

DELETE/v1/checkouts/{id}

Archives a checkout (soft delete). Its published versions and orders stay for history.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/checkouts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Publish a checkout version

POST/v1/checkouts/{id}/publish

Validates the working copy and freezes it as the next immutable version, which the hosted page then serves. Refused with 422 publish_validation_failed and a list of issues (for example a missing payment step, an unknown offer, a return URL not on the store allow-list). Emits checkout.published.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/checkouts/275cd27c-ca97-41ae-aeaa-5caa5355/publish" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

List checkout versions

GET/v1/checkouts/{id}/versions

Published versions of a checkout, newest first. Versions are immutable.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/checkouts/275cd27c-ca97-41ae-aeaa-5caa5355/versions" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

List discounts (coupon codes and automatic discounts)

GET/v1/discounts

used counts uses reserved by a payment in flight or redeemed by a paid order (both count against the limits).

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/discounts" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Create a coupon code or automatic discount

POST/v1/discounts

Percent values are basis points (1000 = 10%), fixed amounts integer minor units with a currency. Codes are matched case-insensitively and unique per store (409 code_taken). Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • storeIdstring · uuid
  • kindstringrequired
    One ofcodeautomatic
  • codestring
    min 3 chars · max 40 chars · pattern ^[A-Za-z0-9_-]+$
  • namestringrequired
    min 1 chars · max 80 chars
  • valueTypestringrequired
    One ofpercentfixed
  • percentBpsinteger
    min 1 · max 10000
  • amountinteger
    greater than 0
  • currencystring
    3 chars
  • minSubtotalinteger
    min 0
  • minQuantityinteger
    min 1 · max 10000
  • usageLimitinteger
    min 1 · max 10000000
  • perCustomerLimitinteger
    min 1 · max 10000
  • startsAtany
  • endsAtany
  • appliesToBumpsboolean
  • activeboolean

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/discounts" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "kind": "code",
  "name": "string",
  "valueType": "percent"
}'
// JSON object. The OpenAPI document does not list its fields.

Retrieve a discount

GET/v1/discounts/{id}

One discount with its limits and usage.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/discounts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Update a discount (null clears a limit, bound or date)

PATCH/v1/discounts/{id}

Changes a discount. null clears an optional limit, bound or date. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Request body · application/jsonrequired

  • namestring
    min 1 chars · max 80 chars
  • valueTypestring
    One ofpercentfixed
  • percentBpsinteger
    min 1 · max 10000
  • amountinteger
    greater than 0
  • currencystring
    3 chars
  • minSubtotalintegernullable
    min 0
  • minQuantityintegernullable
    min 1 · max 10000
  • usageLimitintegernullable
    min 1 · max 10000000
  • perCustomerLimitintegernullable
    min 1 · max 10000
  • startsAtanynullable
  • endsAtanynullable
  • appliesToBumpsboolean
  • activeboolean

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PATCH "$GIEP_API_URL/v1/discounts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "valueType": "percent",
  "percentBps": 1
}'
// JSON object. The OpenAPI document does not list its fields.

Archive a discount

DELETE/v1/discounts/{id}

Archives a discount; it no longer applies to new sessions. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/discounts/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

List custom domains (status pending | verified | active | failed)

GET/v1/domains

Custom checkout domains with their status (pending waiting for DNS, verified TXT matched, active also pointing at the edge, failed), the DNS records to create, the last check and whether the domain is the store primary.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/domains" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Add a custom checkout domain

POST/v1/domains

Normalised (lower case, IDN to punycode). Refused (422): IP addresses, wildcards, special-use names (localhost, .local, .test), a bare public suffix, the platform domains, more than CHECKOUT_DOMAINS_PER_STORE per store. The answer lists the exact DNS records to create: CNAME to the platform edge host (or A/AAAA to the edge addresses for an apex) and the TXT ownership record. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • hostnamestringrequired
    min 1 chars · max 253 chars
  • storeIdstring · uuid

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/domains" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "hostname": "string"
}'
// JSON object. The OpenAPI document does not list its fields.

Remove a custom domain (audited)

DELETE/v1/domains/{id}

Removes a custom checkout domain; it stops serving the checkout. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/domains/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Make an active domain the store primary (new hosted-checkout URLs use it)

POST/v1/domains/{id}/primary

With primary: true, new hosted-checkout URLs of the store use this domain; only an active domain can be primary (422 domain_not_active). Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Request body · application/jsonrequired

  • primarybooleanrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/domains/275cd27c-ca97-41ae-aeaa-5caa5355/primary" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "primary": false
}'
// JSON object. The OpenAPI document does not list its fields.

Re-check a domain: TXT ownership, then DNS routing to the edge

POST/v1/domains/{id}/verify

verified = the TXT record matched; active = verified AND the hostname points at the platform edge (CNAME or address). A DNS resolver failure is a 502, never a failed verdict. Only one merchant can hold a hostname verified (409).

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/domains/275cd27c-ca97-41ae-aeaa-5caa5355/verify" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Store integrations (Shopify, WooCommerce) and whether Shopify is configured

GET/v1/integrations

Per store: how it is connected (Shopify shop, scopes, API version, catalog import state; WooCommerce), without credentials, and whether the Shopify app is configured for this installation.

Authentication
API key (Bearer)
Permission
store:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/integrations" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Privacy requests Shopify sent (data requests and erasures)

GET/v1/integrations/privacy-requests

Customer data requests and erasure requests Shopify forwarded. GIEP handles erasures automatically. Requires audit:read.

Authentication
API key (Bearer)
Permission
audit:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/integrations/privacy-requests" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

One privacy request; a data request carries the customer data to pass on

GET/v1/integrations/privacy-requests/{id}

One privacy request. A data request carries the customer data GIEP holds, for the merchant to send to the customer. Requires audit:read.

Authentication
API key (Bearer)
Permission
audit:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/integrations/privacy-requests/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Storefront checkout redirect status (state, public id, allowed origins, pricing mode, snippet)

GET/v1/integrations/shopify/{storeId}/checkout-redirect

Whether the redirect block is installed in the live theme, the store's public id, the allowed storefront origins, whether a Storefront token is stored (pricing: storefront_api or admin_api) and a manual install snippet. Requires store:read.

Authentication
API key (Bearer)
Permission
store:read
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/integrations/shopify/string/checkout-redirect" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Install the checkout redirect in the live Shopify theme

POST/v1/integrations/shopify/{storeId}/checkout-redirect/install

Backs up layout/theme.liquid (SecretStore reference) and adds a marked block before </head>; installing twice replaces the block. 409 missing_scope without write_themes, theme_markers_broken, theme_no_head, in_progress; 502 when Shopify refuses or does not answer (the theme is left as it was). Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/integrations/shopify/string/checkout-redirect/install" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Remove the checkout redirect from the Shopify theme

POST/v1/integrations/shopify/{storeId}/checkout-redirect/remove

Removes the marked block (later theme edits stay). With damaged markers it answers 409 confirm_restore_required unless confirmRestoreBackup: true is sent, because restoring the stored original overwrites later edits. 409 theme_changed when the file changed while it was being edited, app_uninstalled after an uninstall (remove the block by hand). Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Request body · application/jsonrequired

  • confirmRestoreBackupboolean

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/integrations/shopify/string/checkout-redirect/remove" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "confirmRestoreBackup": false
}'
// JSON object. The OpenAPI document does not list its fields.

Set the storefront domains and the Storefront API token

PUT/v1/integrations/shopify/{storeId}/checkout-redirect/settings

Replaces the custom storefront domains the script may call from and/or stores (or clears with null) the Storefront API access token in the SecretStore. The token is never returned. Audited without the token.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Request body · application/jsonrequired

  • domainsarray<string>
    max 10 items
  • storefrontTokenstringnullable
    min 8 chars · max 200 chars

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PUT "$GIEP_API_URL/v1/integrations/shopify/string/checkout-redirect/settings" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "domains": [
    "string"
  ],
  "storefrontToken": "string"
}'
// JSON object. The OpenAPI document does not list its fields.

Import or re-sync the Shopify catalog (one checkout item per variant)

POST/v1/integrations/shopify/{storeId}/sync-catalog

Reads every active product and variant, upserts them (external id = variant GID) and deactivates variants removed in Shopify. 409 when the store is not connected; 502 when Shopify does not answer (nothing changes). Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/integrations/shopify/string/sync-catalog" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

List offers

GET/v1/offers

Order bumps and post-purchase upsells, optionally for one checkoutId.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Query parameters

  • checkoutIdstring · uuid

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/offers" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Create an offer (bump / upsell)

POST/v1/offers

Creates an order bump (added before payment) or a post-purchase upsell for one checkout. amount is integer minor units in currency; prices holds explicit prices in other presentment currencies (never converted). Place it on the page in the checkout editor.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • checkoutIdstring · uuidrequired
  • kindstringrequired
    One ofbumpupsell
  • productIdstring · uuid
  • titlestringrequired
    min 1 chars · max 200 chars
  • descriptionstring
    max 2000 chars
  • amountintegerrequired
    greater than 0
  • currencystringrequired
    3 chars
  • pricesany
  • positioninteger
    min 0 · max 1000

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/offers" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "checkoutId": "679010dc-dba5-41d2-a1d7-5b76-d95",
  "kind": "bump",
  "title": "string",
  "amount": 4999,
  "currency": "USD"
}'
// JSON object. The OpenAPI document does not list its fields.

Retrieve an offer

GET/v1/offers/{id}

One offer: kind (bump or upsell), checkout, price, per-currency prices, position and active state.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/offers/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Update an offer

PATCH/v1/offers/{id}

Changes title, description, price, per-currency prices, position or active state of an offer.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Request body · application/jsonrequired

  • titlestring
    min 1 chars · max 200 chars
  • descriptionstring
    max 2000 chars
  • amountinteger
    greater than 0
  • pricesany
  • positioninteger
    min 0 · max 1000
  • activeboolean

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PATCH "$GIEP_API_URL/v1/offers/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "title": "string",
  "description": "string",
  "amount": 4999
}'
// JSON object. The OpenAPI document does not list its fields.

Archive an offer

DELETE/v1/offers/{id}

Deactivates the offer (same as active: false); the record stays for order history.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/offers/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Orders (paid checkouts), newest first

GET/v1/orders

The merchant's orders with customer, total and the latest payment. Filters: storeId (one of your stores; 404 otherwise), status, q (order id, store order reference or customer email). Keyset pagination: pass nextBefore back as before. Amounts are integer minor units.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Query parameters

  • statusstring
    One ofopenpaidpartially_refundedrefundedcancelled
  • qstring
    max 200 chars
  • storeIdstring · uuid
  • limitinteger
    min 1 · max 100
  • beforestring

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/orders" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

One order with lines, discounts, shipping, tax, payments and refunds

GET/v1/orders/{id}

Line amounts of kind discount are the reduction (positive); tax lines marked inclusive are already part of the total. Each payment lists its refunds (pending and unknown refunds count as spent).

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/orders/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Create a payment link

POST/v1/payment-links

A shareable link that opens the published version of a checkout for a fixed amount (integer minor units). Optional product, per-currency prices, reusable and expiresAt.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • checkoutIdstring · uuidrequired
  • titlestringrequired
    min 1 chars · max 200 chars
  • productIdstring · uuid
  • amountintegerrequired
    greater than 0
  • currencystringrequired
    3 chars
  • pricesany
  • reusableboolean
  • expiresAtany

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/payment-links" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "checkoutId": "679010dc-dba5-41d2-a1d7-5b76-d95",
  "title": "string",
  "amount": 4999,
  "currency": "USD"
}'
// JSON object. The OpenAPI document does not list its fields.

List products

GET/v1/products

Products of the merchant (title, price in integer minor units, per-currency prices, SKU, image, external id, inventory, active).

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/products" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Create a product

POST/v1/products

Creates a product for a store. price is integer minor units of currency; prices holds explicit prices in other presentment currencies (never converted). Shopify stores import products instead (sync-catalog).

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • storeIdstring · uuid
  • titlestringrequired
    min 1 chars · max 200 chars
  • descriptionstring
    max 5000 chars
  • skustring
    max 100 chars
  • priceintegerrequired
    min 0
  • currencystringrequired
    3 chars
  • imageUrlstring · uri
  • externalIdstring
    max 200 chars
  • inventoryinteger
    min 0
  • pricesany

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/products" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "title": "string",
  "price": 4999,
  "currency": "USD"
}'
// JSON object. The OpenAPI document does not list its fields.

Retrieve a product

GET/v1/products/{id}

One product: title, price in integer minor units, per-currency prices, SKU, image, external id, inventory and active state.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/products/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Update a product

PATCH/v1/products/{id}

Changes a product, or deactivates it with active: false.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Request body · application/jsonrequired

  • titlestring
    min 1 chars · max 200 chars
  • descriptionstring
    max 5000 chars
  • skustring
    max 100 chars
  • priceinteger
    min 0
  • imageUrlstring · uri
  • externalIdstring
    max 200 chars
  • inventoryinteger
    min 0
  • pricesany
  • activeboolean

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PATCH "$GIEP_API_URL/v1/products/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "title": "string",
  "description": "string",
  "sku": "string"
}'
// JSON object. The OpenAPI document does not list its fields.

Archive a product

DELETE/v1/products/{id}

Deactivates the product (same as active: false); the record stays for order history.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/products/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Hosted-checkout features of a store: wallets, Places autocomplete, cart consent

GET/v1/stores/{storeId}/checkout-features

Each wallet shows whether the store turned it on and whether the platform side exists (configured, missing): Apple Pay needs the platform domain-association file, Google Pay the merchant id, PayPal an enabled PayPal connector.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/stores/string/checkout-features" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Change hosted-checkout features (audited; consent version bumps on a wording change)

PUT/v1/stores/{storeId}/checkout-features

Turns wallets (Apple Pay, Google Pay, PayPal), Google Places autocomplete (browser key) and cart capture (consent mode off, notice or checkbox, consent text, retention 1-730 days) on or off for a store. Changing the consent wording starts a new consent version. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Request body · application/jsonrequired

  • applePayEnabledboolean
  • googlePayEnabledboolean
  • paypalEnabledboolean
  • placesEnabledboolean
  • placesBrowserKeystringnullable
    max 100 chars
  • cartCapturestring
    One ofoffnoticecheckbox
  • consentTextstringnullable
    max 300 chars
  • cartRetentionDaysinteger
    min 1 · max 730

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PUT "$GIEP_API_URL/v1/stores/string/checkout-features" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "applePayEnabled": false,
  "googlePayEnabled": false,
  "paypalEnabled": false
}'
// JSON object. The OpenAPI document does not list its fields.

A store's hosted checkout settings

GET/v1/stores/{storeId}/checkout-settings

A store's hosted checkout settings, such as how long after payment post-purchase offers can be accepted (upsellWindowMinutes).

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/stores/string/checkout-settings" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Change a store's hosted checkout settings

PUT/v1/stores/{storeId}/checkout-settings

upsellWindowMinutes (1..1440, default 15): how long after payment post-purchase offers can be accepted. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Request body · application/jsonrequired

  • upsellWindowMinutesintegerrequired
    min 1 · max 1440

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PUT "$GIEP_API_URL/v1/stores/string/checkout-settings" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "upsellWindowMinutes": 1
}'
// JSON object. The OpenAPI document does not list its fields.

A store's signing secret status (never the value)

GET/v1/stores/{storeId}/signing-secret

Configured or not, merchant or legacy source, the last 4 characters and, during a rotation, until when the previous secret also signs.

Authentication
API key (Bearer)
Permission
webhook:read
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/stores/string/signing-secret" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Generate the store's signing secret (shown once)

POST/v1/stores/{storeId}/signing-secret

Signs the return URLs (giep_sig). The value is in this response only. 409 when one exists (rotate instead). Audited.

Authentication
API key (Bearer)
Permission
webhook:manage
Idempotency-Key
Not used
Success
201

Path parameters

  • storeIdstringrequired

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/stores/string/signing-secret" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

End a rotation overlap now (the previous secret stops signing)

POST/v1/stores/{storeId}/signing-secret/revoke-previous

During the 24-hour rotation overlap, stops the previous secret now (return URLs signed with it no longer verify). Audited.

Authentication
API key (Bearer)
Permission
webhook:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/stores/string/signing-secret/revoke-previous" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Rotate the store's signing secret (shown once; 24 h overlap)

POST/v1/stores/{storeId}/signing-secret/rotate

The new secret signs at once; for 24 hours the previous one also signs (giep_sig_prev), so the shop can switch without failed verifications. revokeNow: true (a leaked secret): the previous one stops signing at once. Audited.

Authentication
API key (Bearer)
Permission
webhook:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • storeIdstringrequired

Request body · application/jsonrequired

  • revokeNowboolean
    Default false

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/stores/string/signing-secret/rotate" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "revokeNow": false
}'
// JSON object. The OpenAPI document does not list its fields.

List tax rules

GET/v1/tax-rules

Tax rules: name, rate (basis points), country, optional region, inclusive or exclusive, whether shipping is taxed, active.

Authentication
API key (Bearer)
Permission
sell:read
Idempotency-Key
Not used
Success
200

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X GET "$GIEP_API_URL/v1/tax-rules" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.

Create a tax rule

POST/v1/tax-rules

Matches the shopper country (and region when set). Rate in basis points (500 = 5%). Exclusive tax is added to the total; inclusive tax is shown as included. Rounding: ADR 0009. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
201

Request body · application/jsonrequired

  • storeIdstring · uuid
  • namestringrequired
    min 1 chars · max 60 chars
  • rateBpsintegerrequired
    min 1 · max 10000
  • countrystringrequired
    pattern ^[A-Za-z]{2}$
  • regionstring
    min 1 chars · max 10 chars
  • inclusiveboolean
  • appliesToShippingboolean
  • positioninteger
    min 0 · max 1000
  • activeboolean

Responses

  • 201Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 201 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X POST "$GIEP_API_URL/v1/tax-rules" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "rateBps": 1,
  "country": "US"
}'
// JSON object. The OpenAPI document does not list its fields.

Update a tax rule

PATCH/v1/tax-rules/{id}

Changes a tax rule or activates / deactivates it. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Request body · application/jsonrequired

  • namestring
    min 1 chars · max 60 chars
  • rateBpsinteger
    min 1 · max 10000
  • countrystring
    pattern ^[A-Za-z]{2}$
  • inclusiveboolean
  • appliesToShippingboolean
  • positioninteger
    min 0 · max 1000
  • activeboolean
  • regionstringnullable
    min 1 chars · max 10 chars

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 422Validation failed (invalid_request) Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X PATCH "$GIEP_API_URL/v1/tax-rules/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "rateBps": 1,
  "country": "US"
}'
// JSON object. The OpenAPI document does not list its fields.

Archive a tax rule

DELETE/v1/tax-rules/{id}

Archives a tax rule; it no longer applies to new sessions. Audited.

Authentication
API key (Bearer)
Permission
sell:manage
Idempotency-Key
Not used
Success
200

Path parameters

  • idstringrequired

Responses

  • 200Success
  • 401Missing or invalid credentials Body is an error object with code and message.
  • 403Role not permitted Body is an error object with code and message.
  • 429Rate limited (rate_limited); see Retry-After Body is an error object with code and message.

The 200 response is a JSON object. The OpenAPI document does not describe its fields.

Request · cURL
curl -X DELETE "$GIEP_API_URL/v1/tax-rules/275cd27c-ca97-41ae-aeaa-5caa5355" \
  -H "Authorization: Bearer $GIEP_API_KEY"
// JSON object. The OpenAPI document does not list its fields.