01DEVELOPER DOCUMENTATION

Build with the
commerce API.

Explore the storefront and customer contracts behind Rocento. Request schemas, response models and authentication requirements, together in one reference.

Explore endpoints Download OpenAPI JSON

Application API preview · Read-only reference

Choose the reference for your work.

Storefront and customer APIs

The public reference below covers reviewed shopping, customer account, fulfillment, content and support operations. Each endpoint documents the credentials it requires.

Merchant administration APIs

In your store administration, open System → API reference. Your role needs View API documentation permission. The reference loads only after the server verifies your session and current permission.

Internal services

Assistant delegation, service operations and internal contracts remain in the private engineering reference. They are not available through public documentation or merchant documentation access.

02GET STARTED

Your store is the API host.

Use the HTTPS origin of your approved Rocento installation, followed by /api. Endpoint paths below start with /v1. The corporate website at rocento.com hosts documentation; it is not a shared merchant API.

curl --fail-with-body \
  'https://YOUR-STORE.example/api/v1/catalog/categories' \
  --header 'Accept: application/json'

Replace the example hostname with your installation. This sample reads the catalog without sending credentials.

03AUTHENTICATION

Access follows the customer.

Catalog discovery is public where indicated. Customer endpoints use Authorization: Bearer <access_token>, issued by the customer login flow. Refresh and guest-cart sessions use cookies managed by the installation.

Mutating requests require X-Commerce-Request: 1 and must satisfy the deployment’s origin checks. Checkout additionally requires a verified customer. The backend checks ownership and permissions on every protected operation.

Keep credentials out of URLs, logs and source code. Use an approved test installation for development. This page has no credential entry or request execution.

Request and response conventions

JSON and identifiers

Send JSON with Content-Type: application/json where a body is specified. Treat IDs as opaque strings and follow each operation’s schema for prices, currencies, pagination and required fields.

Errors and retries

Inspect the HTTP status and documented error body. Authentication failures use 401; access restrictions use 403. For 429 or temporary 503 responses, honor Retry-After when present. Retry writes only according to that operation’s idempotency contract.

Store boundaries

Each merchant has a separate database and installation. Customer tokens and administrator sessions belong to that installation. Request bodies cannot select another merchant or grant ownership. Delivery, availability and checkout totals are validated against current store data.

04ENDPOINT REFERENCE

Explore the contract.

Open full reference ↗

Filter by API group, expand an operation, and inspect its parameters and models. The viewer is powered by Swagger UI and uses the same downloadable OpenAPI document.

Need administrative or partner integration access? Contact the Rocento team to agree on scope and access.