Sellxora API

Sellxora E-commerce API

Public documentation: https://sellxora.com/api/docs
API base URL: https://sellxora.com/api
Format: JSON unless an endpoint accepts multipart file uploads.

This page documents only Sellxora's e-commerce APIs. The public documentation page is intentionally available without signing in, so developers and AI coding tools can inspect the integration contract. Reading this page does not grant API access.

Access models

Sellxora exposes two e-commerce API surfaces:

  1. Public store API — buyer-facing storefront catalog, guest cart, checkout handoff, and verified buyer order tracking. A merchant must publish the store and enable its Store Mobile API switch in Ecommerce settings. These endpoints are store-scoped and do not require a merchant API key.
  2. Merchant API — product and order management endpoints under /api/products, /api/categories, and /api/orders. These require an API key generated in Account Settings. API keys can be created and used only when the merchant has an active Ecommerce subscription whose SaaS plan enables E-commerce API Keys.

API keys are integration credentials restricted server-side to the e-commerce merchant endpoints. They cannot be used for CRM, marketing, AI, creator, billing, or other Sellxora APIs. The SaaS plan entitlement is checked on each API-key request, so expiry or disabling the feature revokes access without requiring a key rotation.

Authentication for the merchant API

Send the key in the HTTP Authorization header. Do not put keys in query parameters, URLs, browser code, mobile app bundles, public repositories, or logs.

Authorization: Bearer YOUR_SELLXORA_ECOMMERCE_API_KEY
Accept: application/json
Content-Type: application/json

A key is shown only once when created. Store it in a server-side secret manager or protected environment variable. Revoke keys that are exposed or no longer needed.

Merchant API endpoints

All merchant endpoints require a valid e-commerce API key and an active Ecommerce plan with the API-key feature enabled. The authenticated user can access only their own records.

Method Endpoint Purpose
GET /products/currencies Return supported e-commerce currencies
GET /products List the authenticated merchant's products
POST /products Create a product assigned to one of the merchant's stores
GET /products/{id} Read a product and its safe order summary
POST /products/{id} Update a product
DELETE /products/{id} Delete a product and its associated images/download file
DELETE /products/{id}/images Remove one image by its stored path
DELETE /products/{id}/images/all Remove all product images
GET /products/categories?store_id={storeId} List categories assigned to a merchant-owned store
GET /categories?store_id={storeId} Category-list compatibility endpoint
GET /orders List the authenticated merchant's orders
GET /orders/summary?days=30 Return order/revenue summary for a recent period
GET /orders/{id} Read an order, line items, and total
PATCH /orders/{id}/status Update order status
PATCH /orders/{id}/paid Update the order's paid flag where permitted by the existing API
PATCH /orders/{id}/tracking Save carrier and tracking details
DELETE /orders/{id} Delete an order

Listing products

GET /products supports these query parameters:

Example:

curl -sS 'https://sellxora.com/api/products?per_page=15&is_publish=1' \
  -H 'Accept: application/json' \
  -H 'Authorization: Bearer YOUR_SELLXORA_ECOMMERCE_API_KEY'

Creating a product

The create endpoint requires purchase_store_id, name, price, and currency. Optional fields include category_id, sku, compare_price, description, product_type (physical or digital), stock/dimension fields, and is_publish. The store and category must belong to the authenticated merchant; the category must be assigned to the selected store.

Product images are sent as multipart file uploads using the images[] field. Accepted formats are JPG, JPEG, PNG, and WebP, up to 5 MB per image. The server enforces the supported validation rules.

Example JSON body:

{
  "purchase_store_id": 12,
  "name": "Example product",
  "price": 25000,
  "currency": "NGN",
  "product_type": "physical",
  "is_publish": true
}

Updating an order

PATCH /orders/{id}/status accepts status values OPEN, COMPLETED, or CANCELED.

PATCH /orders/{id}/paid accepts a boolean is_paid. Treat this as a privileged merchant action and do not use it as proof that an online gateway payment succeeded. Gateway payment state must be established by Sellxora's server-side provider verification flow.

PATCH /orders/{id}/tracking accepts tracking_number (nullable text, max 100 characters), tracking_url (nullable valid URL, max 2048 characters), and optional carrier_name (nullable text, max 100 characters). At least one of tracking number or tracking URL must be provided. The response contains the updated order.

Example:

PATCH /api/orders/123/tracking
Authorization: Bearer YOUR_SELLXORA_ECOMMERCE_API_KEY
Accept: application/json
Content-Type: application/json

{
  "carrier_name": "DHL",
  "tracking_number": "JD014600006281234567",
  "tracking_url": "https://www.dhl.com/global-en/home/tracking.html?tracking-id=JD014600006281234567"
}

Public store API

The public store API base URL is:

https://sellxora.com/api/mobile/stores/{storeSlug}

Replace {storeSlug} with the store slug. The store must be published and its owner must enable Store Mobile API for that store. These endpoints expose only published store/catalog data and buyer flows for that specific store.

Storefront and catalog

Method Endpoint Purpose
GET / Store name, slug, currency, branding, selling-country settings
GET /categories Categories assigned to the store
GET /products?per_page=20&search=shirt&category_id=12 Published, visible products with pagination
GET /products/{productSlug} One visible published product and configured variations

Guest cart

  1. Call GET /cart without a cart token to create a store-specific guest cart.
  2. Save the returned cart_token.
  3. Send X-Store-Cart-Token: YOUR_CART_TOKEN on subsequent cart calls.
  4. Use POST /cart/items with JSON fields product_id, optional quantity, and optional variation_key.
  5. Use PATCH /cart/items/{productId} with quantity and optional variation_key to update a line. Quantity zero removes it.
  6. Use DELETE /cart/items/{productId} to remove a line, optionally specifying variation_key.
  7. Use DELETE /cart to clear the cart.

Cart tokens are store-bound and expire after 30 days. The API recalculates prices from the current catalog. Cart totals exclude shipping, taxes, and coupon discounts until checkout.

Checkout and payment handoff

Send name, email, and paymentmethod. For physical products, also send address, city, and the two-letter country code. Optional fields include phone, phone_country_code, state, zip, shipping_rate_id, coupon_code, and customer_note.

Use a payment method enabled for the store. Depending on the gateway and payment method, checkout may return a gateway handoff or a JSON redirect_url. Follow the returned URL in the client as appropriate. Do not mark an order paid based solely on a redirect or client-side success screen: Sellxora must verify the provider payment on the server. Keep the cart token available until checkout succeeds; the cart is retained after checkout errors.

Buyer order access (no buyer sign-up)

  1. POST /buyer/request-code with JSON {"email":"[email protected]"}.
  2. POST /buyer/verify-code with JSON {"email":"[email protected]","code":"123456"}.
  3. If eligible orders exist for that email and store, the response returns a bearer token.
  4. Send Authorization: Bearer YOUR_TOKEN on buyer order requests.
  5. GET /buyer/orders lists orders for the verified email and store.
  6. GET /buyer/orders/{orderToken} returns one order and shipment details.
  7. POST /buyer/logout revokes the buyer access token.

Verification codes expire after 10 minutes and have resend/attempt protections. Buyer tokens expire after 30 days. Responses intentionally avoid disclosing order eligibility before verification.

Errors and client behavior

HTTP status Meaning Recommended client action
400 Malformed request or invalid state Correct the request/state
401 Missing/invalid credential or expired cart token Authenticate or refresh the relevant token
403 SaaS plan entitlement missing or API key used outside e-commerce scope Upgrade/enable access or use the correct credential
404 Store/resource not found or not visible to this caller Check slug/ID and ownership
409 Conflict or duplicate operation Re-fetch state before retrying
422 Validation failed Display field errors and correct input
429 Rate limit exceeded Back off and retry with jitter
500/503 Temporary server/provider error Do not assume payment or order creation failed; check status before retrying

Collection responses may use Laravel pagination fields such as current_page, last_page, per_page, and total. Treat response bodies as endpoint-specific and rely on the documented fields rather than assuming every endpoint returns the same envelope.

Security and production integration checklist