Authenticate with a store API key, then call orders, catalog, marketing, Meta ads, and reports. Safe for AI tools when you send confirm: true on risky writes.
https://admin.shopiz.app/api/staff/v1YOUR_COMPANY_ID
· header X-Company-Id
Find your numeric Company ID on Technical → API in the store admin.
Route inventory with tags — not full request schemas. Use the recipes below.
curl -s "https://admin.shopiz.app/api/staff/v1/capabilities" \
-H "Authorization: Bearer YOUR_KEY" \
-H "X-Company-Id: YOUR_COMPANY_ID" \
-H "Accept: application/json"
curl -s -X POST "https://admin.shopiz.app/api/staff/v1/marketing/sms/campaigns" \
-H "Authorization: Bearer YOUR_KEY" \
-H "X-Company-Id: YOUR_COMPANY_ID" \
-H "Content-Type: application/json" \
-H "Idempotency-Key: sms-draft-1" \
-d '{"name":"Flash","message":"Hi","segment":"has_orders","confirm":true}'
Products, collections, blog, orders, reports, settings, and outbound webhooks.
GET https://admin.shopiz.app/api/staff/v1/capabilities
Start every AI session with this. Returns permission booleans.
POST https://admin.shopiz.app/api/staff/v1/categories
Collections in admin = /categories in the API.
{
"name": "Gadgets",
"is_active": true
}
POST https://admin.shopiz.app/api/staff/v1/products
Destructive product deletes need confirm: true.
{
"name": "Wireless mouse",
"price": 899,
"is_active": true
}
POST https://admin.shopiz.app/api/staff/v1/blog
{
"title": "How to choose a power bank",
"status": "draft"
}
GET https://admin.shopiz.app/api/staff/v1/reports/sales-summary?period=last_30_days
GET /reports for the full slug list. period=today|yesterday|last_7_days|last_30_days|this_month|custom&from=&to=
PATCH https://admin.shopiz.app/api/staff/v1/orders/{id}/status
Common statuses follow admin order pipeline.
{
"status": "confirmed"
}
GET https://admin.shopiz.app/api/staff/v1/store-settings/company
PATCH with field keys from the section. See Store settings sections below.
POST https://admin.shopiz.app/api/staff/v1/webhooks confirm
HTTPS only. Secret shown once. Delivery header X-Shopiz-Signature = HMAC-SHA256(body, secret). Events: order.confirmed, order.status_changed, order.cancelled, ping
{
"url": "https://example.com/hooks/shopiz",
"events": ["order.confirmed", "order.status_changed"],
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/integrations/daraz/orders/pull confirm
Also: GET /integrations/daraz · POST /integrations/daraz/products/sync. Connect Daraz in Settings → Integrations first.
{
"confirm": true
}
Coupons, SMS, automations, popups, special offers, email, and ads. Marketing report slugs are under Report slugs below.
POST https://admin.shopiz.app/api/staff/v1/coupons
type: percent | fixed | free_shipping. Coupons do not need confirm.
{
"code": "SAVE10",
"type": "percent",
"value": 10,
"is_active": true
}
POST https://admin.shopiz.app/api/staff/v1/marketing/sms/audiences confirm
Segments: all, has_orders, no_orders, paid, never_paid, due, partially_paid, confirmed, abandoned, registered_range, ordered_range, manual_numbers
{
"name": "Buyers",
"segment": "has_orders",
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/marketing/sms/campaigns confirm
Then launch: POST /marketing/sms/campaigns/{id}/launch with confirm:true + Idempotency-Key
{
"name": "Flash sale",
"message": "Today 10% off with SAVE10",
"segment": "has_orders",
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/marketing/automations confirm
Calendar = scheduled.campaign + scheduled_date MM-DD. Other triggers: checkout.abandoned, customer.registered, customer.inactive, order.placed, order.delivered, order.cancelled, product.viewed
{
"name": "Eid campaign",
"trigger_type": "scheduled.campaign",
"scheduled_date": "04-10",
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/marketing/popups confirm
Toggle live: POST /marketing/popups/{id}/toggle
{
"name": "Welcome offer",
"type": "discount",
"is_active": false,
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/marketing/special-offers confirm
type: product | collections | combo (needs product_id / category_id / product_combo_id)
{
"name": "Summer deal",
"type": "product",
"product_id": 1,
"is_active": true,
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/marketing/email-campaigns confirm
Update draft: PATCH /marketing/email-campaigns/{id}
{
"name": "Weekly picks",
"subject": "This week’s bestsellers",
"confirm": true
}
POST https://admin.shopiz.app/api/staff/v1/ads/meta/campaigns/{id}/status confirm
Also: GET /marketing/meta-ads · GET /ai/ads/brief · PATCH …/budget. Use Idempotency-Key.
{
"status": "PAUSED",
"confirm": true
}
Create / edit discount codes (no confirm). Apply via POST /orders/{id}/coupon.
Writes need confirm: true. Launch accepts Idempotency-Key.
Writes need confirm: true. Calendar = trigger scheduled.campaign + scheduled_date MM-DD.
Writes need confirm: true. Visual designer stays in admin.
Writes need confirm: true.
Draft create/update need confirm: true. Visual email designer stays in admin.
Read Meta / Google performance (no platform tokens returned).
Writes need confirm: true + prefer Idempotency-Key. Secrets stay on Shopiz.
GET|PATCH /store-settings/{section}
company
branding
homepage
site
language
tax
invoice
shipping
email_orders
whatsapp
facebook
social_login
seo
easy_checkout
security
fraud
pos
header
performance
footer
payments
domain
couriers
email_delivery
sms_delivery
floating_contact
offers
referral
plan
waba
whatsapp_business
Collections = /categories. Destructive deletes need confirm: true.
Lead CSV import needs confirm: true.
GET /reports lists every report. GET /reports/{slug}?period=last_30_days.
Add blog post = POST /blog.
WABA template send needs confirm: true.
GET|PATCH /store-settings/{section}. plan / waba may be read-only.
Webhook create/delete need confirm: true. GET /capabilities for permission map.
API tokens from Management replace login for AI tools.
GET /reports/{slug}?period=last_30_days — includes Marketing (coupon, SMS, Meta ROAS, etc.) once here.