Information
- OpenAPI version:
3.0.0
Overview
Front API 1.0
Section titled “Front API 1.0”The Front API lets you build your own buyer and vendor experience on top of a Kreezalid marketplace: a custom storefront, a headless front end or a mobile app. Every call acts on behalf of one signed-in member of the marketplace (a buyer, a vendor, or both), never as the marketplace owner. To manage the whole marketplace from a back-end system, use the Admin API instead.
Base URL
Send every request to your marketplace’s own domain, followed by /front_api/v1:
https://acme.mykreezalid.com/front_api/v1If your marketplace uses a custom domain, call that domain: the primary one, exactly as it is configured (with or without www).
Request bodies are accepted as JSON (Content-Type: application/json) or as form data. Responses are JSON.
Authentication
- Create an account with
POST /account/create, or use an existing one. - Sign in with
POST /auth/login, sending the member’semailandpassword. The response carries an access token indata.token. - Send that token in the
Authorizationheader of every following request:
Authorization: Bearer <token>The token is valid for one year from the moment it is issued and is bound to the marketplace that issued it. There is no refresh endpoint: when a token expires or is rejected, sign in again to get a new one. DELETE /auth/logout ends the server-side session, but does not revoke the token itself: delete it from your app when the member signs out.
GET /auth/me returns the member the token belongs to.
Requests made from the marketplace’s own pages with the member’s session cookie are accepted too, so theme scripts can call the Front API without a token.
Public endpoints
Some endpoints work without a token: browsing categories, vendor profiles, related listings, listing attributes and reviews, and most cart endpoints, since a cart is addressed by its own key (creating and reading a cart, adding, updating and removing items, reading a quantity, choosing a shipping method). Each endpoint shows whether it needs a token. When a public endpoint receives a valid token anyway, it acts for that member. Account creation, sign-in and the password-recovery endpoints only work without a token: a signed-in member gets 403 Forbidden.
Errors
A request that needs a member and does not identify one is refused with 403 Forbidden and a JSON body such as:
{ "code": 403, "status": "error", "message": "Token not found in request" }Most validation errors use the same shape, with the matching status code.
Authentication
Section titled “Authentication”bearerAuth
Section titled “bearerAuth”Access token returned by POST /auth/login, sent as Authorization: Bearer <token>. Valid for one year; sign in again to get a new one.
Security scheme type: http
Bearer format: JWT