MMashDiv

API and data

The e-commerce endpoints, what they are scoped to, and the tables behind them.

1 min readUpdated 3 August 2026api, reference, orders

Two surfaces. Everything under /api/ecommerce is scoped to the signed-in customer. Everything under /api/admin/ecommerce carries an explicit permission.

The platform pins the status at 200 and puts the real outcome in the body. Read the body — a client that branches on the status code will treat a refused order as a completed one.

Customer endpoints

GET/api/ecommerce/product
Browse the catalogue
GET/api/ecommerce/product/{id}
One product with its variants and media
GET/api/ecommerce/category
Categories, for navigation and filtering
POST/api/ecommerce/cart/checkout
Check out the signed-in customer's cart
GET/api/ecommerce/order
The customer's orders
GET/api/ecommerce/order/{id}
One order in full
GET/api/ecommerce/download/{orderItemId}
Download a purchased digital product
GET/api/ecommerce/shipping
Shipping options for an address
POST/api/ecommerce/discount/validate
Validate a discount code against the cart
GET/api/ecommerce/wishlist
The customer's wishlist
POST/api/ecommerce/review/{productId}
Leave a review on a product
GET/api/ecommerce/landing
Landing page content

Admin endpoints

Each requires its own permission; access to the addon alone is not enough.

GET/api/admin/ecommerce/dashboard
Shop dashboard figures
GET/api/admin/ecommerce/product
Product management
GET/api/admin/ecommerce/category
Category management
GET/api/admin/ecommerce/order
Order management, including status changes
GET/api/admin/ecommerce/discount
Discount codes
GET/api/admin/ecommerce/shipping
Shipping rules
GET/api/admin/ecommerce/review
Review moderation
GET/api/admin/ecommerce/wishlist
Wishlist records

Reading the tables directly

Two things bite anyone querying the database rather than the API:

  • Money is DECIMAL, and the driver returns it as a STRING. "1" + 1 is "11". Coerce before any arithmetic.
  • Stock decrements when an order is PAID, not when it is placed. A pending order has not reserved anything.

Order status is the single source of truth for whether a customer is entitled to a digital download — do not infer it from payment records.