Products API

List products

GET /platform/v1/products — scope read_products, cursor-paginated.

curl "https://admin.prebit.in/api/platform/v1/products?limit=50" \
  -H "Authorization: Bearer $ACCESS_TOKEN"

{
  "products": [
    { "id": "...", "name": "Coffee Mug", "slug": "coffee-mug", "price": 499, "isActive": true, "stock": 40, "variants": [] }
  ],
  "nextCursor": "6683a1..."
}

Create a product

POST /platform/v1/products — scope write_products, requires Idempotency-Key.

curl -X POST https://admin.prebit.in/api/platform/v1/products \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{ "name": "Coffee Mug", "price": 499, "sku": "MUG-001", "stock": 40 }'

Response: 201 { "data": { "id": "...", ...every field } }.

Editable fields

name, price, currencyCode, imageUrl, vendorName, isActive, description, media, discountedPrice, onSale, sku, category, categoryId, categoryName, productType, metafields, slug, trackInventory, stock, options, variants, faqs, customFields, tags, costPrice, taxable, barcode, seoTitle, seoDescription, metaDescription, weight, dimensions, countryOfOrigin, hsCode, productKind. Only name is required on create. price/ discountedPrice/costPrice/stock (and the same fields per-variant) must be non-negative numbers.

Update a product

PATCH /platform/v1/products/:id — scope write_products, requires Idempotency-Key. Same editable fields as create; only send what's changing.

const { data } = await client.updateProduct(productId, { price: 549 }, crypto.randomUUID());

Delete a product

DELETE /platform/v1/products/:id — scope write_products, requires Idempotency-Key. No confirmation gate — the scope grant is the safety gate (the merchant approved write_products at install).

await client.deleteProduct(productId, crypto.randomUUID());

Set inventory

See the dedicated Inventory page — PATCH /platform/v1/products/:id/inventory.

Domain events this API emits

Every product write (yours, the dashboard's, or the AI agent's) emits catalog.product.updated.v1. If your installation made the write, that event carries your originInstallationId so you never get an echo of your own change — but every other app subscribed to product.updated still gets notified. See Webhooks.

Errors