Developers

Connect Boutora to your existing tools.

A versioned REST API, signed outgoing webhooks and an MCP server for AI assistants. The same tokens, the same business rules and the same per-store isolation.

Create an account OpenAPI specification

REST API/api/v1, OpenAPI 3.1, cursor pagination, idempotent POST.
Outgoing webhooksHMAC-SHA256, retries for up to 24 h, secret rotation, SSRF protection.
MCP server44 merchant tools and a public storefront that AI can read.

REST API /api/v1

Read and update products, inventory, orders, customers and webhook endpoints. Integer amounts in the smallest unit, ISO 8601 UTC dates, CORS closed: the API is built for your servers.

Resources

GET /products, /products/{id}catalog:read
POST, PATCH /products, /products/{id}catalog:write
POST /inventory/adjustmentsinventory:write
GET /orders, /orders/{id}orders:read
POST /orders/{id}/transitionsorders:write
GET /customers, /customers/{id}customers:read
GET, POST, DELETE /webhooks, /webhooks/{id}webhooks:write

Pagination with ?limit=1..100 and ?cursor=, stable sorting from newest to oldest. Writes run exactly the same business rules as the merchant dashboard: plan quotas, stock never negative, controlled order transitions, audit log.

TOKEN=axi_live_…
BASE=https://16-192-144-250.nip.io/api/v1

curl -s "$BASE/orders?status=NEW,CONFIRMED" \
  -H "Authorization: Bearer $TOKEN"

curl -s -X POST "$BASE/products" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $(uuidgen)" \
  -d '{"name":"Cold brew 1 L","price":1290}'

Every response includes Axi-Api-Version and X-Request-Id.

Bearer token, store inferred
Authorization: Bearer axi_live_… The store comes from the token: no parameter lets you target another one.
Effective scope
Token scopes, intersected with your plan and the creator's role, recomputed on every request.
Idempotency required on POST
Idempotency-Key kept for 24 h: the same request replays the stored response instead of running twice.
RFC 9457 errors
application/problem+json with a stable code, the required scope and a request_id to share with support.

REST API access and number of webhook endpoints by plan
Plan	REST API	Webhooks
Starter	Not included	Not included
Business	Read-only (GET)	2 endpoints
Scale	Read and write	10 endpoints
Enterprise	Read and write	Unlimited

Signed outgoing webhooks

Boutora calls your server on every event. Minimal payload, HMAC signature, retries for up to 24 hours, and an anti-SSRF check before every delivery.

Events

Orders: order.createdorder.updatedorder.status_changedorder.paidorder.refundedorder.cancelled
Catalog: product.createdproduct.updatedproduct.deletedinventory.updated
Customers and after-sales: customer.createdcustomer.updatedreturn.createdreturn.status_changedgiftcard.issued
Service: app.ping

Axi-Event: order.created
Axi-Webhook-Id: evt_3f2a…
Axi-Signature: t=1760184000,v1=5f2b…

v1 = hex(HMAC-SHA256(secret, t + "." + raw_body))

Respond with a 2xx status within 10 seconds and process the event in the background.
Retries at 1 min, 5 min, 30 min, 2 h, 6 h, 12 h, then 24 h.
Deduplicate on Axi-Webhook-Id: delivery is guaranteed at least once.
Secret rotation: two signatures sent for 24 hours.
HTTPS only; private addresses and internal hostnames are refused.

44 MCP tools to run a store.

Every tool checks the token's permissions and the plan's limits, and only ever sees one store. Every change is written to the audit log.

Store

get_store_overview
Identity, plan, currency and key figures: sales today, over 7 and 30 days, average order value, orders to process, best sellers.
Read
list_webhook_deliveries
Outgoing webhook deliveries: status, attempts, HTTP code, error; filter by endpoint, status, event.
Read
list_saved_sections
Saved theme sections: name, type, compatible pages, usage, plan limit.
Read
get_tax_settings
Tax settings: VAT collected or not, tax-inclusive or exclusive, regime, tax identity, rates by country and category, issued invoices.
Read

Catalog

search_products
Search by text, status, tag or collection, with pagination.
Read
get_product
Full product record: variants, options, add-ons, stock, collections.
Read
create_product
Creates a product, as a draft by default, within the plan's limit.
Write
update_product
Title, description, price, sale price, status, tags, collections.
Write
update_variant_price_stock
Price and stock level of a variant, with history.
Write
list_collections
Manual and automated collections with their product count.
Read
add_products_to_collection
Adds products to a manual collection.
Write
get_catalog_sync_status
WhatsApp / Meta catalog: feed URLs, sync status, items rejected by Meta and why.
Read
trigger_catalog_sync
Starts a full sync of the WhatsApp catalog (at most 6 per hour).
Write
set_metafield
Sets or clears a custom field (defined in Boutora) on a product, variant or collection; value validated by type.
Write
list_product_files
Files sold with a digital product: name, size, type, version. Never a storage key or link.
Read

Inventory

adjust_inventory
Stock in or out with a reason, never below zero.
Write
list_low_stock
Out-of-stock and low-stock items, most urgent first.
Read
list_locations
Warehouses, shops and pickup points: role, pickup availability, number of items held.
Read
get_inventory_levels
Stock per location and total stock for each tracked item, flagging discrepancies and oversells.
Read
transfer_stock
Moves units from one location to another (total stock unchanged); confirmation required above 50 units.
Write

Orders

list_orders
Orders filtered by status, payment, period or reference.
Read
get_order
Details, payment, history and possible next statuses.
Read
update_order_status
Moves an order forward through the Boutora lifecycle (stock and customer updated).
Write
add_order_note
Internal note in the history, never visible to the customer.
Write
list_digital_downloads
Download access for digital products: downloads used, limit, expiry, last download. Never a link or token.
Read
create_shipment
Creates a shipment, even a partial one, with an in-house courier or a carrier, plus the handover code to give the shopper.
Write
update_shipment_status
Moves a shipment forward through the allowed transitions only; a shipment that has left can't be cancelled.
Write

Customers

list_customers
Customers with their orders, amount spent and last visit.
Read
get_customer
Contact details, WhatsApp consent, loyalty and history.
Read

Marketing

create_discount_code
Dated promo code: percentage, fixed amount or free delivery.
Write
list_discount_codes
Promo codes, validity and number of uses.
Read
list_automatic_discounts
Automatic discounts (bundles, buy 2 get 1 free, tiers), with a one-sentence summary and status.
Read
create_automatic_discount
Creates an automatic discount; confirmation required above 50%, above the average order value or for a half-price bundle.
Write
set_automatic_discount_active
Turns an automatic discount on or off.
Write
list_blog_posts
Blog posts: status (scheduled and due = published), date, category, tags, public URL.
Read
create_blog_post
Creates a post DRAFT (never published) in limited Markdown, without images; subject to the plan's post quota.
Write

Gift cards

list_gift_cards
Gift cards, balance and status; only the last 4 characters of the code.
Read
issue_gift_card
Issues a gift card (confirmation always required); the code is never returned to the assistant.
Write
grant_store_credit
Adds store credit to a customer with a reason (confirmation always required, also needs customers:read).
Write

Returns

list_returns
Return requests by status, with the shopper's text kept separate.
Read
get_return
Return details: items, reason, amounts, history, next statuses.
Read
update_return_status
Approves, rejects (with a reason), cancels, receives or resolves a return according to its lifecycle.
Write

Analytics

sales_report
Sales by day, week or product, compared with the previous period.
Read
pos_daily_report
Today's in-store sales: count, revenue, payment methods, expected and counted cash, offline price differences.
Read

Make a request, the assistant carries it out.

The assistant reads your Boutora store data, proposes actions, then carries them out only within the permissions you have granted.

“Which products are out of stock?”
A list of sold-out items, set against this month's sales.
“Create a 10% promo code for this weekend.”
Code created with its time window and usage limit, plus a ready-to-send message.
“Summarize this week's sales.”
Revenue trend, average order value and the orders to prepare first.
“Move order BT-7K3P9Q to “preparing”.”
Transition applied by the state machine; the customer is notified.

Illustrative answers: wording varies from one assistant to another.

Compatible with the assistants you already use.

Server address: 16-192-144-250.nip.io/api/mcp.

Claude.ai
Custom connector, one-click sign-in (OAuth 2.1 + PKCE)
From Business
ChatGPT
Developer mode, MCP connector with OAuth
From Business
Claude Desktop and Claude Code
API token, one command to paste
All plans
Cursor, VS Code, Windsurf
mcp.json file with your token
All plans
Your agents and automations
Any HTTP MCP client: n8n, Make, in-house scripts
All plans

A public storefront that AI can read.

Every published store can open its catalog to assistants: they find products, check availability and delivery, then prepare a cart that the shopper confirms themselves.

get_store_info
Overview, opening hours, WhatsApp contact, delivery, payments and terms.
search_catalog
Products for sale, current prices and availability.
get_product
Public product page: variants, add-ons, photos.
check_availability
Checks that a cart can be ordered right now.
get_delivery_options
Delivery zones and fees, pickup time slots.
create_checkout_link
Prepares a cart: the shopper opens the link and confirms the order themselves.

POST /api/mcp/store/{slug}
GET  /s/{slug}/llms.txt

Access without authentication, rate-limited by IP address and can be disabled at any time. No customer data, orders or payments are exposed. For more information, see the artificial intelligence page.

An App Store to extend your store.

Merchants install apps from their dashboard with clear permissions. Developers build, test and publish their own apps and make them available to every store.

One-click install
Requested permissions are shown before installation; apps can be uninstalled at any time.
Developer workspace
App creation, OAuth credentials, test installs on your own store and review before publishing.
Embedded apps
Your interface is displayed inside the merchant dashboard, with a session token verified server-side.

Access under your control.

The same rules as for your team: each access is limited to what is necessary.

Per-store API tokens
Shown only once, stored hashed, with expiry, rotation and instant revocation.
OAuth 2.1 for one-click sign-in
PKCE required, one-hour tokens renewed by rotation, a Boutora consent screen.
Strict isolation
Each access is tied to a single store. Your plan and your role limit what it can do.
Logs and quotas
Every call is logged for 30 days; per-minute and per-day quotas protect your store.

AI connector included in every plan

Starter: Read and write, 3 tokens
Business: Full, OAuth, 10 tokens
Scale: Full, unlimited tokens
Enterprise: Full, custom quotas

Permissions

Store informationstore:read
Read the catalogcatalog:read
Edit the catalogcatalog:write
Adjust inventoryinventory:write
Read ordersorders:read
Process ordersorders:write
Customer datacustomers:read
Sales statisticsanalytics:read
Promo codesmarketing:write
Gift cards and store creditgiftcards:write
Contentcontent:write
Webhookswebhooks:write
Store themetheme:write

Frequently asked questions

The full reference (tools, OAuth, examples, error codes) comes with your account.

What is the difference between the REST API and the MCP server?

Both access the same store, with the same business rules and the same tokens. The REST API is designed for your servers: stable routes, cursor pagination, idempotency, an OpenAPI specification. The MCP server is designed for AI assistants: it exposes tools described in natural language, which Claude or ChatGPT select themselves.

Which plans include REST API access?

Read-only (GET) from the Business plan, read and write from Scale. Outgoing webhooks follow the same logic: 2 endpoints on Business, 10 on Scale, unlimited on Enterprise. The MCP connector is included in every plan, trial included.

How do I verify a webhook signature?

Every delivery carries an Axi-Signature header in the form t=timestamp,v1=signature, where v1 is the HMAC-SHA256 of “timestamp.raw_body” using your whsec_ secret. Compute it on the raw body you received, compare in constant time, and reject anything more than 300 seconds apart. During a secret rotation, two v1 values are sent for 24 hours.

What is MCP?

The Model Context Protocol is an open standard that lets an AI assistant use external tools. Boutora exposes a stateless Streamable HTTP MCP server: Claude, ChatGPT or Cursor can view and manage your store when you ask them to.

Can an assistant place an order on a customer's behalf?

No. On the public storefront, an assistant can only prepare a cart link: the shopper opens that link, chooses delivery and confirms the order.

Is my customer data protected?

Names, phone numbers and addresses are only shared with the “customer data” permission. Webhooks send no personal data by default. Every call is logged, every access can be revoked in one click, and secrets are stored hashed or encrypted: Boutora cannot read them back.

Test the integration with your own store.

Create a token from the AI Connectors page, or connect Claude.ai in one click from the Business plan.

Create my store See pricing

Connect Boutora to your existing tools.

REST API /api/v1

Resources

Bearer token, store inferred

Effective scope

Idempotency required on POST

RFC 9457 errors

Signed outgoing webhooks

Events

44 MCP tools to run a store.

Store

Catalog

Inventory

Orders

Customers

Marketing

Gift cards

Returns

Analytics

Make a request, the assistant carries it out.

Compatible with the assistants you already use.

Claude.ai

ChatGPT

Claude Desktop and Claude Code

Cursor, VS Code, Windsurf

Your agents and automations

A public storefront that AI can read.

An App Store to extend your store.

One-click install

Developer workspace

Embedded apps

Access under your control.

Per-store API tokens

OAuth 2.1 for one-click sign-in

Strict isolation

Logs and quotas

AI connector included in every plan

Permissions

Frequently asked questions

Test the integration with your own store.