API and data
The e-commerce endpoints, what they are scoped to, and the tables behind them.
1 min readUpdated 3 August 2026api, reference, orders
Two surfaces. Everything under /api/ecommerce is scoped to the signed-in
customer. Everything under /api/admin/ecommerce carries an explicit
permission.
The platform pins the status at 200 and puts the real outcome in the body.
Read the body — a client that branches on the status code will treat a refused
order as a completed one.
Customer endpoints
Browse the catalogue
One product with its variants and media
Categories, for navigation and filtering
Check out the signed-in customer's cart
The customer's orders
One order in full
Download a purchased digital product
Shipping options for an address
Validate a discount code against the cart
The customer's wishlist
Leave a review on a product
Landing page content
Admin endpoints
Each requires its own permission; access to the addon alone is not enough.
Shop dashboard figures
Product management
Category management
Order management, including status changes
Discount codes
Shipping rules
Review moderation
Wishlist records
Reading the tables directly
Two things bite anyone querying the database rather than the API:
- Money is DECIMAL, and the driver returns it as a STRING.
"1" + 1is"11". Coerce before any arithmetic. - Stock decrements when an order is PAID, not when it is placed. A pending order has not reserved anything.
Order status is the single source of truth for whether a customer is entitled to a digital download — do not infer it from payment records.