Endpoints

Forty-seven endpoints, all relative to https://aov-cart-drawer.firebaseapp.com/store-api/v1. Thirteen are GET and work with any key. The other thirty-four change the cart drawer and need a read and write key.

Every request carries Authorization: Bearer aov_sk_…. See Overview for creating a key and for the response envelope.

Each endpoint is the HTTP form of an MCP tool. The MCP tool column names it and links to the tool guide, which explains what the fields mean. This page covers only the HTTP side: paths, parameters and rules.

Query parameters on a GET go in the URL. pageSize is 1–50 wherever it is accepted. Where a read returns a page and there is more, the response includes a cursor to pass back unchanged.

Two cart drawer generations

A store's cart drawer is either the first generation (built from templates) or the second generation (built from zone styles). Most endpoints work on both. A few belong to one:

Calling one on the wrong generation returns TOOL_UNAVAILABLE_FOR_STATE (409), and the message names the generation the store uses. GET /context tells you which one you have before you try.

/context

No parameters. A good first call. What it returns is described under get_store_context.

curl "https://aov-cart-drawer.firebaseapp.com/store-api/v1/context" \
  -H "Authorization: Bearer aov_sk_YOUR_KEY"

/configuration-options

The values the write endpoints accept, so you do not have to guess identifiers. What each domain lists is described under get_configuration_options.

Query:

/setup-health

No parameters. What it checks, and the issue codes it returns, are described under get_setup_health.

/drawer-settings

The saved cart drawer configuration, together with its revision. Read it before you write. What each section holds is described under get_drawer_settings.

Query:

Ask for only the sections you need. The whole configuration is large.

The MCP tool also takes offsets. This API does not: to page through a long list, send the cursor from the previous response.

{"success": true, "data": {"revision": 42, "…": "…"}, "error": null}

/products

Search products by name, handle, vendor or status.

Query:

Send at least one of name, handle, vendor or status. name and handle cannot be combined. What each result contains is described under Finding products, collections and discounts, which also covers /products/variants, /collections and /discounts.

/products/variants

The variants of one product, with their ids.

Query:

/collections

Query: name (required), pageSize, cursor.

/discounts

Query: name (required), pageSize.

Only the first 100 eligible discounts are searched, so a store with more may not see every match. Narrow name rather than assuming a missing discount does not exist.

/analytics

Cart drawer performance over a date range. What each figure means is described under get_analytics.

Query:

Leave both out for the last 30 days. The range can be at most 400 days. A longer one is refused with INVALID_INPUT and the message "that window is longer than 400 days. Ask for a shorter period."

curl "https://aov-cart-drawer.firebaseapp.com/store-api/v1/analytics?start=2026-08-01&end=2026-08-31" \
  -H "Authorization: Bearer aov_sk_YOUR_KEY"

/templates

First generation only. What it lists is described under get_all_templates.

/translations

The wording the drawer shows in one language.

Query: template and locale (for example fr or pt-BR). What text and translations hold is described under get_translations.

/plan

The store's plan and whether it includes the Store API. No parameters. What the plan state means is described under get_plan_status.

/operation-status

Query: operationId — the 64-character id a write returned. What it reports is described under get_operation_status.

Writing

Write endpoints take a JSON object as the body. Send Content-Type: application/json. The body mirrors the input of the matching MCP tool, named in the MCP tool column of the tables below, so the field meanings are in the MCP tool guide and how every change behaves is in Writing: how every change behaves; this API adds only the HTTP shape.

curl -X PATCH "https://aov-cart-drawer.firebaseapp.com/store-api/v1/reward-bar/settings" \
  -H "Authorization: Bearer aov_sk_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"expectedRevision": 42, "requestId": "reward-bar-2026-08-31"}'

Saved, and what it returns

A write that commits returns:

{"success": true, "data": {"status": "saved", "revision": 43, "changed": ["…"], "operationId": "…"}, "error": null}

revision is the new revision. changed lists which documents were touched. When an operationId is present you can follow it with GET /operation-status?operationId=…. A saved change is then published to the storefront; if publishing is still running or did not finish, POST /configuration-publication/retry with the revision you were given as expectedRevision retries it.

A write that did not commit returns success: false with a 409 (or 422) and the reason in error.code. Nothing was changed. See A write that was not saved.

expectedRevision and requestId

Both are optional on every write, with one exception: POST /configuration-publication/retry requires expectedRevision.

Confirming deletions

Removing a reward tier or an upsell rule, and switching template, needs ?confirm=true on the URL. Without it the request is refused and nothing is removed.

Write endpoints

Every one needs a read and write key. Paths marked 1st or 2nd generation work only on that generation.

Settings

Blocks

Rewards

Upsell

Add-ons and publishing

The write limits are under Limits. See Errors for what a refused write looks like.