Storefront APIs

Build a storefront on Vondera

Public REST APIs for catalog, cart, checkout, customers, funnels, and content — 74 endpoints documented from production routes.

This page documents Storefront APIs only (building / customizing shopfronts). For Plugin apps, OAuth, and scopes, use the Developers Portal.

Developers Portal

Overview

These routes power Vondera storefronts. The same router is mounted twice: authenticate with your merchant API key on /api/public, or let live shop domains resolve the store via host headers on /api/ecommerce.

Base URLhttps://production.api.vondera.app

Public key mounthttps://production.api.vondera.app/api/public

Host-resolved mounthttps://production.api.vondera.app/api/ecommerce

Response envelope

Most JSON endpoints return:

{
  "status": 200,
  "message": "Success",
  "data": {}
}

74 endpoints across 12 resources.

Authentication

Merchant API key (x-api-key)

Open the Merchant Dashboard → Developers / API Key.
Copy your public API key (requires a plan with apiAccess).
Send it as the x-api-key header on every /api/public request.
Never embed the key in public browser bundles — call from your backend or a trusted server.

Dashboard path: https://dashboard.vondera.app/dashboard/api

Open API key settings

Customer JWT

Account routes under /customer require Authorization: Bearer <token> from signup or login. Cart and checkout use userid / sessionId headers for guest sessions.

Useful headers

Header	Description
`x-api-key`	Store API key — required on /api/public
`language / locale`	Locale (default en)
`sessionId`	Anonymous session for cart & analytics
`userid`	Cart identity (defaults to sessionId)
`Authorization`	Bearer <customer JWT> for account routes
`x-store-domain / Host`	Store host — used by /api/ecommerce (checkUrl)

Enums

String values accepted by checkout, cart, and theme payloads.

paymentMethod / gatewayType

CASHCash on delivery
GATEWAYOnline card / payment gateway
DEPOSITPartial deposit then remainder COD
MANUALMerchant-configured manual payment (requires manualPaymentMethodId)

pickupMethod

SHIPPINGDeliver to customer address (default)
PICKUPCustomer picks up at a store location
EMAILDigital / email fulfillment (when enabled)

Cart line type

PRODUCTStandard product line (default)
BUNDLEProduct offer bundle — send bundleId + variants[]
GROUP_BUNDLEKit of components — send componentSelections[]

Order payment.paymentStatus

PENDINGAwaiting payment / COD
PAIDFully paid
PARTIALDeposit paid, remainder outstanding

Store

Bootstrap, shipping geography, builder settings, feeds, and attribution.

GET/store

Store bootstrap

Storefront settings, theme, SEO, features, currency, and checkout flags.

Query

Name	Type	Required	Description
`versionId`	`string`	No	Optional website version preview id

curl --request GET 'https://production.api.vondera.app/api/public/store' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

404 Store not found
400/404 invalid versionId

GET/store/shipping-countries

Shipping countries

List shipping countries for the current storefront market (global market stores).

curl --request GET 'https://production.api.vondera.app/api/public/store/shipping-countries' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/store/zones

Cities / zones

City/zone list used for checkout shipping.

Query

Name	Type	Required	Description
`country`	`string`	No	Override market country code

curl --request GET 'https://production.api.vondera.app/api/public/store/zones' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

400 unsupported country

GET/store/shipping-options

Shipping options

Available shipping options for a market/country.

Query

Name	Type	Required	Description
`country`	`string`	No	Market country code

curl --request GET 'https://production.api.vondera.app/api/public/store/shipping-options' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/store/pickup-locations

Pickup locations

Active pickup locations for PICKUP checkout.

curl --request GET 'https://production.api.vondera.app/api/public/store/pickup-locations' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/store/subzones

Courier sub-zones

Courier sub-zones for a city when showCourierZonesInCheckout is enabled.

Query

Name	Type	Required	Description
`cityId`	`string`	Yes	City / zone id

curl --request GET 'https://production.api.vondera.app/api/public/store/subzones' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

400 when courier zones disabled or invalid city

GET/store/builder/settings

Builder settings

Published (or draft) home-builder page sections for the storefront.

Query

Name	Type	Required	Description
`withDraft`	`boolean`	No	Include draft when true
`versionId`	`string`	No	Website version preview id

curl --request GET 'https://production.api.vondera.app/api/public/store/builder/settings' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/store/sitemaptext/xml

XML sitemap

XML sitemap of products and pages for SEO.

curl --request GET 'https://production.api.vondera.app/api/public/store/sitemap' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/store/catalog

JSON catalog feed

JSON product catalog feed.

curl --request GET 'https://production.api.vondera.app/api/public/store/catalog' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/store/catalog.csvtext/csv

CSV catalog feed

CSV product catalog feed (legacy path).

curl --request GET 'https://production.api.vondera.app/api/public/store/catalog.csv' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

POST/store/referral

Record referral / UTM

Record referral / UTM attribution for the browser session.

Headers

Name	Type	Required	Description
`sessionId`	`string`	No	Anonymous session id (also accepted as sessionid)

Body fields

Name	Type	Required	Description
`referrer`	`string`	No	—
`source`	`string`	No	—
`medium`	`string`	No	—
`campaign`	`string`	No	—
`content`	`string`	No	—
`term`	`string`	No	—
`landing`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/store/referral' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"referrer":"https://google.com","source":"google","medium":"cpc","campaign":"spring"}'

POST/store/visit

Record storefront visit

Analytics visit ping for the storefront session.

Headers

Name	Type	Required	Description
`sessionId`	`string`	No	Anonymous session id

curl --request POST 'https://production.api.vondera.app/api/public/store/visit' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{}'

Products

Catalog listing, PDP lookup, reviews, Q&A, and view tracking.

GET/products

List products

Paginated visible products. Supports search/filters passed through to the catalog DAO / Typesense.

Query

Name	Type	Required	Description
`limit`	`number`	Yes	Page size
`pageNo`	`number\|string`	No	Page number or cursor token
`page`	`number\|string`	No	Alias of pageNo
`fullData`	`boolean`	No	true for full ProductMapper.toEcommerce
`cursorMode`	`string`	No	Cursor pagination mode when enabled
`categoryId`	`string`	No	—
`subCategoryId`	`string`	No	—
`q`	`string`	No	Search query (alias: search)
`sortBy`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

400 validation (missing limit)

GET/products/v2/

List products (cursor v2)

Cursor-based product list using pageKey.

Query

Name	Type	Required	Description
`limit`	`number`	Yes	—
`pageKey`	`string`	No	—
`fullData`	`boolean`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products/v2/' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/products/featured

Featured products

Query

Name	Type	Required	Description
`fullData`	`boolean`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products/featured' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/products/single/slug/:slug

Product by slug

Full product detail by URL slug.

Query

Name	Type	Required	Description
`variantId`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products/single/slug/{slug}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

404 Product Not Found

GET/products/single/resolve/:param

Resolve product

Resolve a product by id or slug in one path param.

Query

Name	Type	Required	Description
`variantId`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products/single/resolve/{param}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

404 Product Not Found

GET/products/single/:id

Product by id

Full product detail by id.

Query

Name	Type	Required	Description
`variantId`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products/single/{id}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

404 Product Not Found

POST/products/by-ids

Products by ids

Batch fetch products by ids (order preserved; missing → null).

Body fields

Name	Type	Required	Description
`ids`	`string[]`	Yes	—
`fullData`	`boolean`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/products/by-ids' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"ids":["Product_abc","Product_def"],"fullData":false}'

Errors

400 empty ids

POST/products/:productId/view

Record product view

Record a product view analytics event.

Headers

Name	Type	Required	Description
`x-event-id`	`string`	No	Client event idempotency key

curl --request POST 'https://production.api.vondera.app/api/public/products/{productId}/view' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{}'

Errors

400 Product id required

POST/products/:productId/review

Submit review

Submit a product review (images optional as base64).

Body fields

Name	Type	Required	Description
`rating`	`number`	Yes	—
`name`	`string`	Yes	—
`email`	`string`	Yes	—
`review`	`string`	No	—
`imagesBase64`	`string[]`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/products/{productId}/review' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"rating":5,"name":"Sara","email":"sara@example.com","review":"Great quality"}'

Errors

400 validation
404 product

GET/products/:productId/review

List reviews

Paginated product reviews.

Query

Name	Type	Required	Description
`pageNo`	`number`	Yes	—
`limit`	`number`	Yes	—
`sort`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/products/{productId}/review' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

POST/products/:productId/qa

Ask a question

Submit a product Q&A question.

Body fields

Name	Type	Required	Description
`question`	`string`	Yes	—
`name`	`string`	Yes	—
`email`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/products/{productId}/qa' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"question":"Is this waterproof?","name":"Omar","email":"omar@example.com"}'

GET/products/:productId/qa

List Q&A

Paginated product questions & answers.

Query

Name	Type	Required	Description
`pageNo`	`number`	Yes	—
`limit`	`number`	Yes	—

curl --request GET 'https://production.api.vondera.app/api/public/products/{productId}/qa' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Cart

Session cart keyed by userid / sessionId headers.

GET/cart

Get cart

Current session cart. Empty cart if no userId.

Headers

Name	Type	Required	Description
`userid`	`string`	No	Cart identity (defaults to sessionId)
`sessionId`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/cart' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/cart/count

Cart count

Cart line-item count.

curl --request GET 'https://production.api.vondera.app/api/public/cart/count' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/cart/suggestions

Cart suggestions

Cross-sell / cart suggestions for the current cart.

curl --request GET 'https://production.api.vondera.app/api/public/cart/suggestions' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

POST/cart

Add to cart

Add a PRODUCT, BUNDLE, or GROUP_BUNDLE line.

Body fields

Name	Type	Required	Description
`productId`	`string`	Yes	—
`quantity`	`number`	No	Required for PRODUCT (> 0)
`variantId`	`string`	No	—
`type`	`PRODUCT\|BUNDLE\|GROUP_BUNDLE`	No	Default PRODUCT
`bundleId`	`string`	No	Required for BUNDLE
`variants`	`string[]`	No	Variant ids for BUNDLE lines
`componentSelections`	`object[]`	No	[{ componentId, variantId }] for GROUP_BUNDLE
`customizationResponses`	`object[]`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/cart' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"productId":"Product_abc","quantity":1,"variantId":"var_1","type":"PRODUCT"}'

Errors

400 invalid productId / quantity / bundle mismatch
404 Product/Bundle not found

PUT/cart

Update cart line

Update quantity / selection for an existing cart line.

Body fields

Name	Type	Required	Description
`productId`	`string`	Yes	—
`quantity`	`number`	Yes	—
`variantId`	`string`	No	—
`type`	`PRODUCT\|BUNDLE\|GROUP_BUNDLE`	No	—
`variants`	`string[]`	No	—
`bundleId`	`string`	No	—
`customizationResponses`	`object[]`	No	—

curl --request PUT 'https://production.api.vondera.app/api/public/cart' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"productId":"Product_abc","quantity":2,"variantId":"var_1","type":"PRODUCT"}'

Errors

400/404 validation

DELETE/cart/item

Remove cart line

Remove one cart line.

Body fields

Name	Type	Required	Description
`productId`	`string`	Yes	—
`variantId`	`string`	No	—
`type`	`PRODUCT\|BUNDLE\|GROUP_BUNDLE`	No	—
`variants`	`string[]`	No	—
`bundleId`	`string`	No	—
`customizationResponses`	`object[]`	No	—

curl --request DELETE 'https://production.api.vondera.app/api/public/cart/item' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"productId":"Product_abc","variantId":"var_1","type":"PRODUCT"}'

DELETE/cart

Clear cart

Clear the entire cart for the session user.

curl --request DELETE 'https://production.api.vondera.app/api/public/cart' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

POST/cart/view

Record cart view

Analytics event when the cart UI is opened.

Headers

Name	Type	Required	Description
`x-event-id`	`string`	No	—

Body fields

Name	Type	Required	Description
`eventId`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/cart/view' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{}'

POST/cart/funnel-abandon

Funnel abandon cart

Record an abandoned funnel checkout cart for recovery.

Body fields

Name	Type	Required	Description
`productId`	`string`	Yes	—
`quantity`	`number`	No	—
`variantId`	`string`	No	—
`type`	`PRODUCT\|BUNDLE\|GROUP_BUNDLE`	No	—
`variants`	`string[]`	No	—
`bundleId`	`string`	No	—
`componentSelections`	`object[]`	No	—
`customizationResponses`	`object[]`	No	—
`funnelId`	`string`	No	—
`funnelLinkId`	`string`	No	—
`funnelName`	`string`	No	—
`schemaVersion`	`number`	No	—
`isVersion2`	`boolean`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/cart/funnel-abandon' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"productId":"Product_abc","quantity":1,"funnelLinkId":"summer-offer","funnelId":"fun_1"}'

Orders & Checkout

Payment methods, pricing, discount validation, and order creation.

GET/orders/payment-methods

Payment methods

Active payment methods for the checkout country.

Query

Name	Type	Required	Description
`shippingCountry`	`string`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/orders/payment-methods' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

400 unsupported shipping country

POST/orders/discount/validate

Validate discount

Validate a promo code against cart products.

Body fields

Name	Type	Required	Description
`code`	`string`	Yes	—
`products`	`object[]`	No	Cart lines with id, quantity, …
`cityId`	`string`	No	—
`pickupMethod`	`SHIPPING\|PICKUP`	No	—
`shippingCountry`	`string`	No	—
`shippingOptionId`	`string`	No	—
`subZoneId`	`string`	No	—
`gatewayType`	`CASH\|GATEWAY\|DEPOSIT\|MANUAL`	No	—
`gatewayId`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/orders/discount/validate' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"code":"SAVE10","products":[{"id":"Product_abc","quantity":1,"variantId":"var_1"}],"gatewayType":"CASH","pickupMethod":"SHIPPING"}'

POST/orders/price

Calculate price

Calculate items, shipping, taxes, gateway fees, and discounts.

Body fields

Name	Type	Required	Description
`products`	`array`	Yes	—
`discountCode`	`string`	Yes	May be empty string
`cityId`	`string`	No	—
`pickupMethod`	`SHIPPING\|PICKUP`	No	—
`gatewayType`	`CASH\|GATEWAY\|DEPOSIT\|MANUAL`	No	—
`gatewayId`	`string`	No	—
`shippingOptionId`	`string`	No	—
`shippingCountry`	`string`	No	—
`subZoneId`	`string`	No	—
`skipAutoApply`	`boolean`	No	—
`funnelId`	`string`	No	—
`funnelLinkId`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/orders/price' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"products":[{"id":"Product_abc","quantity":1,"variantId":"var_1","type":"PRODUCT"}],"discountCode":"","cityId":"cairo","pickupMethod":"SHIPPING","gatewayType":"CASH"}'

Errors

400 Invalid city / shipping country

POST/orders/init-checkout

Init checkout

Fire checkout-initiated analytics. Body shape matches /orders/price.

curl --request POST 'https://production.api.vondera.app/api/public/orders/init-checkout' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"products":[{"id":"Product_abc","quantity":1}],"discountCode":"","pickupMethod":"SHIPPING","gatewayType":"CASH"}'

Errors

400 Invalid city / shipping country

POST/orders

Create order

Create a checkout order. Rate-limited per IP. Captcha may be required for CASH/MANUAL.

Body fields

Name	Type	Required	Description
`name`	`string`	Yes	—
`phone`	`string`	Yes	—
`email`	`string`	Yes	—
`notes`	`string`	Yes	May be empty string
`paymentMethod`	`CASH\|GATEWAY\|DEPOSIT\|MANUAL`	Yes	—
`discountCode`	`string`	Yes	May be empty string
`products`	`array`	Yes	—
`otherPhone`	`string`	No	—
`address`	`string`	No	—
`city`	`string`	No	—
`cityId`	`string`	No	—
`countryCode`	`string`	No	—
`pickupMethod`	`SHIPPING\|PICKUP\|EMAIL`	No	—
`courierSubZoneId`	`string`	No	—
`subZoneId`	`string`	No	—
`subZoneName`	`string`	No	—
`shippingOptionId`	`string`	No	—
`pickupLocationId`	`string`	No	—
`shippingCountry`	`string`	No	—
`manualPaymentMethodId`	`string`	No	—
`receiptImage`	`string`	No	—
`turnstileToken`	`string`	No	Required when store.requireCheckoutCaptcha
`cloudFlareToken`	`string`	No	Alias of turnstileToken
`skipAutoApply`	`boolean`	No	—
`funnelId`	`string`	No	—
`funnelLinkId`	`string`	No	—
`funnelName`	`string`	No	—
`templateId`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/orders' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"name":"Ahmed Hassan","phone":"01012345678","email":"ahmed@example.com","notes":"","paymentMethod":"CASH","discountCode":"","products":[{"id":"Product_abc","quantity":1,"variantId":"var_1","type":"PRODUCT"}],"address":"12 Nile St","cityId":"cairo","countryCode":"+20","pickupMethod":"SHIPPING"}'

Errors

400 validation / captcha / stock / payment method
429 rate limit

GET/orders/single/:id

Get order

Fetch an order by id (host-market scoped). Customer PII may be masked.

curl --request GET 'https://production.api.vondera.app/api/public/orders/single/{id}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

404 Order Not Found

Customer Account

Storefront customer auth, profile, orders history, and wishlist. JWT routes need Authorization: Bearer.

POST/customer/signup

Sign up

Body fields

Name	Type	Required	Description
`name`	`string`	Yes	—
`email`	`string`	Yes	—
`password`	`string`	Yes	Min 6 characters
`phone`	`string`	Yes	—
`address`	`string`	No	—
`gov`	`string`	No	—
`countryCode`	`string`	No	—
`newsLetterEnabled`	`boolean`	No	—
`cloudFlareToken`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/customer/signup' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"name":"Sara Ali","email":"sara@example.com","password":"secret12","phone":"01098765432","newsLetterEnabled":true}'

Errors

400 invalid email/phone/name/password
400 email/phone already exists
400 captcha failure

POST/customer/login

Log in

Customer login. Migrates guest cart into the customer id.

Body fields

Name	Type	Required	Description
`email`	`string`	Yes	—
`password`	`string`	Yes	—

curl --request POST 'https://production.api.vondera.app/api/public/customer/login' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"email":"sara@example.com","password":"secret12"}'

Errors

401 Invalid Email or Password

GET/customerCustomer JWT

Current customer

Profile for the authenticated customer (password never returned).

curl --request GET 'https://production.api.vondera.app/api/public/customer' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en'

Errors

401 Unauthorized

PUT/customer/updateCustomer JWT

Update profile

Update profile fields.

Body fields

Name	Type	Required	Description
`name`	`string`	No	—
`email`	`string`	No	—
`phone`	`string`	No	—
`address`	`string`	No	—
`gov`	`string`	No	—
`countryCode`	`string`	No	—

curl --request PUT 'https://production.api.vondera.app/api/public/customer/update' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"name":"Sara Ali","phone":"01098765432","address":"15 Corniche"}'

Errors

401
400 validation

PUT/customer/change-passwordCustomer JWT

Change password

Change password with current password verification.

Body fields

Name	Type	Required	Description
`currentPassword`	`string`	Yes	—
`newPassword`	`string`	Yes	—

curl --request PUT 'https://production.api.vondera.app/api/public/customer/change-password' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"currentPassword":"secret12","newPassword":"newSecret99"}'

Errors

400 wrong current password

POST/customer/forget

Forgot password

Request password-reset email (always 200 to avoid enumeration).

Body fields

Name	Type	Required	Description
`email`	`string`	Yes	—

curl --request POST 'https://production.api.vondera.app/api/public/customer/forget' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"email":"sara@example.com"}'

POST/customer/reset-password

Reset password

Reset password with the email token.

Body fields

Name	Type	Required	Description
`token`	`string`	Yes	—
`newPassword`	`string`	Yes	—

curl --request POST 'https://production.api.vondera.app/api/public/customer/reset-password' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"token":"reset_token","newPassword":"newSecret99"}'

Errors

400 invalid/expired token

DELETE/customerCustomer JWT

Delete account

Soft-delete account credentials (clears email/password).

curl --request DELETE 'https://production.api.vondera.app/api/public/customer' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en'

GET/customer/ordersCustomer JWT

Customer orders

Logged-in customer order history.

Query

Name	Type	Required	Description
`pageNo`	`number`	No	—
`limit`	`number`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/customer/orders' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en'

GET/customer/wishlistCustomer JWT

Wishlist

Wishlist products.

Query

Name	Type	Required	Description
`page`	`number`	No	—
`limit`	`number`	No	—

curl --request GET 'https://production.api.vondera.app/api/public/customer/wishlist' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en'

POST/customer/wishlistCustomer JWT

Add to wishlist

Add a product to the wishlist.

Body fields

Name	Type	Required	Description
`productId`	`string`	Yes	—

curl --request POST 'https://production.api.vondera.app/api/public/customer/wishlist' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"productId":"Product_abc"}'

Errors

404 product

DELETE/customer/wishlistCustomer JWT

Remove from wishlist

Remove a product from the wishlist.

Body fields

Name	Type	Required	Description
`productId`	`string`	Yes	—

curl --request DELETE 'https://production.api.vondera.app/api/public/customer/wishlist' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'Authorization: Bearer CUSTOMER_JWT' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"productId":"Product_abc"}'

PUT/customer/unsubscribe

Marketing unsubscribe (token)

Unsubscribe from marketing using an email token (no session auth).

Body fields

Name	Type	Required	Description
`unSubscribeToken`	`string`	Yes	—

curl --request PUT 'https://production.api.vondera.app/api/public/customer/unsubscribe' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"unSubscribeToken":"token_…"}'

Errors

400 invalid token

Custom Pages

CMS pages such as policies and about (plan customPagesAccess).

GET/custompages

List custom pages

List custom CMS pages (localized).

curl --request GET 'https://production.api.vondera.app/api/public/custompages' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/custompages/single/:id

Custom page by id/slug

Single custom page by id or link slug.

curl --request GET 'https://production.api.vondera.app/api/public/custompages/single/{id}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

Blogs

Store blog index and live posts (plan blogs access).

GET/blogs

List blogs

Ensure default blog and return blogs metadata.

curl --request GET 'https://production.api.vondera.app/api/public/blogs' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/blogs/posts

List posts

Live blog posts (paginated via limit/offset).

Query

Name	Type	Required	Description
`limit`	`number`	No	1–50, default 20
`offset`	`number`	No	Default 0

curl --request GET 'https://production.api.vondera.app/api/public/blogs/posts' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/blogs/posts/:slug

Post by slug

Single live blog post with SEO payload.

curl --request GET 'https://production.api.vondera.app/api/public/blogs/posts/{slug}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

404 Post Not Found

Funnels

Sales funnel pages (plan funnelsAccess). 410 when the plan does not support funnels.

GET/funnels/:linkId

Funnel by link

Classic funnel payload by public link id.

curl --request GET 'https://production.api.vondera.app/api/public/funnels/{linkId}' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

410 plan does not support funnels
404

GET/funnels/:linkId/v2

Funnel v2

Funnel v2 payload.

curl --request GET 'https://production.api.vondera.app/api/public/funnels/{linkId}/v2' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

GET/funnels/:linkId/page

Funnel page

Rendered funnel page document for storefront hosting.

curl --request GET 'https://production.api.vondera.app/api/public/funnels/{linkId}/page' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

GET/funnels/:linkId/bootstrap

Funnel bootstrap

Checkout bootstrap for a funnel — product, payments, and settings.

curl --request GET 'https://production.api.vondera.app/api/public/funnels/{linkId}/bootstrap' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Errors

Marketing

Newsletter subscribe, popup leads, and checkout contact capture.

POST/marketing/subscribe

Subscribe an email to the store marketing list (consent required).

Body fields

Name	Type	Required	Description
`email`	`string`	Yes	—
`consent`	`boolean`	Yes	—
`source`	`string`	No	Default footer
`phone`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/marketing/subscribe' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"email":"fan@example.com","consent":true,"source":"footer"}'

Errors

400 Invalid email
400 Consent is required

PUT/marketing/unsubscribe

Unsubscribe

Unsubscribe via token (preferred) or email.

Body fields

Name	Type	Required	Description
`email`	`string`	No	—
`token`	`string`	No	—

curl --request PUT 'https://production.api.vondera.app/api/public/marketing/unsubscribe' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"token":"unsub_token"}'

GET/marketing/unsubscribe-linktext/html

One-click unsubscribe (HTML)

Browser / List-Unsubscribe link. Returns HTML, not the JSON envelope.

Query

Name	Type	Required	Description
`token`	`string`	Yes	—

curl --request GET 'https://production.api.vondera.app/api/public/marketing/unsubscribe-link' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

POST/marketing/unsubscribe-link

One-click unsubscribe (POST)

RFC 8058 one-click List-Unsubscribe POST.

Query

Name	Type	Required	Description
`token`	`string`	No	—

Body fields

Name	Type	Required	Description
`token`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/marketing/unsubscribe-link' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"token":"unsub_token"}'

POST/marketing/popup-lead

Popup lead

Capture popup / lead form email or phone. Requires sessionId + userid headers from /store/referral.

Headers

Name	Type	Required	Description
`sessionId`	`string`	Yes	—
`userid`	`string`	Yes	—

Body fields

Name	Type	Required	Description
`email`	`string`	No	—
`phone`	`string`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/marketing/popup-lead' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"email":"lead@example.com"}'

Errors

400 sessionId required
403 Popup feature not enabled

POST/marketing/checkout-contact

Checkout contact

Progressive checkout contact capture (blur/debounce — does not create an order).

Body fields

Name	Type	Required	Description
`email`	`string`	No	—
`phone`	`string`	No	—
`consent`	`boolean`	No	—
`funnelId`	`string`	No	—
`funnelLinkId`	`string`	No	—
`funnelName`	`string`	No	—
`schemaVersion`	`number`	No	—
`isVersion2`	`boolean`	No	—

curl --request POST 'https://production.api.vondera.app/api/public/marketing/checkout-contact' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"email":"shopper@example.com","phone":"01012345678","consent":true}'

Catalog Feeds

CSV feeds for Meta, TikTok, and Google Merchant Center.

GET/catalogs/meta-catalog.csvtext/csv

Meta catalog CSV

Meta / Facebook product catalog CSV feed.

curl --request GET 'https://production.api.vondera.app/api/public/catalogs/meta-catalog.csv' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/catalogs/tiktok-catalog.csvtext/csv

TikTok catalog CSV

TikTok product catalog CSV feed.

curl --request GET 'https://production.api.vondera.app/api/public/catalogs/tiktok-catalog.csv' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

GET/catalogs/google-catalog.csvtext/csv

Google catalog CSV

Google Merchant Center CSV feed.

curl --request GET 'https://production.api.vondera.app/api/public/catalogs/google-catalog.csv' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en'

Password Unlock

Host-scoped unlock when the storefront has password protection enabled. Mounted at /storefront/*.

POST/storefront/unlock

Unlock storefront

Verify password and set unlock cookie / return token.

Body fields

Name	Type	Required	Description
`password`	`string`	Yes	—

curl --request POST 'https://production.api.vondera.app/api/public/storefront/unlock' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"password":"store-password"}'

Errors

400 Password protection is not enabled
401 Incorrect password

POST/storefront/unlock/verify

Verify unlock token

Verify an unlock token when the storefront host cannot verify HMAC locally.

Body fields

Name	Type	Required	Description
`token`	`string`	Yes	—

curl --request POST 'https://production.api.vondera.app/api/public/storefront/unlock/verify' \
  --header 'x-api-key: YOUR_API_KEY' \
  --header 'language: en' \
  --header 'Content-Type: application/json' \
  --data '{"token":"…"}'

Overview

Response envelope

Authentication

Merchant API key (x-api-key)

Customer JWT

Useful headers

Enums

paymentMethod / gatewayType

pickupMethod

Cart line type

Order payment.paymentStatus

themeing.popUpMessage.type

Store

Store bootstrap

Query

Errors

Shipping countries

Cities / zones

Query

Errors

Shipping options

Query

Pickup locations

Courier sub-zones

Query

Errors

Builder settings

Query

XML sitemap

JSON catalog feed

CSV catalog feed

Record referral / UTM

Headers

Body fields

Record storefront visit

Headers

Products

List products

Query

Errors

List products (cursor v2)

Query

Featured products

Query

Product by slug

Query

Errors

Resolve product

Query

Errors

Product by id

Query

Errors

Products by ids

Body fields

Errors

Record product view

Headers

Errors

Submit review

Body fields

Errors

List reviews

Query

Ask a question

Body fields

List Q&A

Query

Categories

List categories

Category by id

Errors

Cart

Get cart

Headers

Cart count

Cart suggestions

Add to cart

Body fields

Errors