Agentic Commerce API

Agentic Commerce endpoints exposed by the Devotel CPaaS API Base path: /api/v1/public/commerce/acp Endpoint count: 5

ACP storefront discovery manifest (public)

GET /api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce

Unauthenticated Agentic Commerce Protocol discovery manifest for a merchant’s published storefront: protocol version, capabilities, accepted payment methods, and the endpoint paths a shopping agent drives. Rate-limited per IP. Unknown/unpublished storefronts 404.

string

required

—

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/.well-known/agentic-commerce');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{}

ACP hosted product feed (public)

GET /api/v1/public/commerce/acp/{storefrontId}/feed

Unauthenticated ACP product feed a shopping agent browses to discover a merchant’s published catalog. Prices are in MAJOR currency units. Rate-limited per IP. Unknown/unpublished storefronts 404.

string

required

—

cURL

curl -X GET "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/feed" \
  -H "X-API-Key: dv_live_sk_your_key_here" 

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/feed', {
  method: 'GET',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
  },
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
r = requests.get("https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/feed", headers=headers)
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("GET", "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/feed", nil)
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))

	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/feed')
req = Net::HTTP::Get.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']


res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/feed');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'GET');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),

]);

echo curl_exec($ch);

{}

Open a public ACP checkout session

POST /api/v1/public/commerce/acp/{storefrontId}/checkout

Open an ACP checkout session for a published storefront. Requested items are priced server-side against the merchant’s STORED catalog (no catalog is accepted from the caller), so a forged price can never enter the cart. Rate-limited per IP.

string

required

—

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout", headers=headers, json={})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout", bytes.NewBuffer([]byte(`{}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{}
JSON);
echo curl_exec($ch);

{}

Complete a public ACP checkout under a verified agent mandate

POST /api/v1/public/commerce/acp/{storefrontId}/checkout/complete

Complete a ready ACP checkout session under the shopping agent’s AP2 payment mandate. Gated on a VERIFIED Web Bot Auth agent signature (Orbit’s own key or a merchant-trusted foreign agent directory): an anonymous (401) or unverifiable (403) caller is rejected before any charge. Once verified, the session is re-priced server-side against the merchant’s STORED catalog and the mandate’s scope + spend caps are re-verified before authorizing, so a caller can never spend past the mandate. No money moves on our side. Rate-limited per IP.

string

required

—

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/complete" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/complete', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/complete", headers=headers, json={})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/complete", bytes.NewBuffer([]byte(`{}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/complete')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/complete');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{}
JSON);
echo curl_exec($ch);

{}

Update a public ACP checkout session

POST /api/v1/public/commerce/acp/{storefrontId}/checkout/update

Re-price an ACP checkout session for a new requested-item set (replace-items semantics), server-side against the merchant’s STORED catalog. Rate-limited per IP.

string

required

—

cURL

curl -X POST "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/update" \
  -H "X-API-Key: dv_live_sk_your_key_here" \
  -H "Content-Type: application/json" \
  -d '{}'

Node.js

import { Orbit } from '@devotel-orbit/node'

const orbit = new Orbit({
  apiKey: process.env.ORBIT_API_KEY!,
})

const res = await fetch('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/update', {
  method: 'POST',
  headers: {
    'X-API-Key': process.env.ORBIT_API_KEY!,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({}),
})
console.log(await res.json())

Python

import os, requests

headers = {"X-API-Key": os.environ["ORBIT_API_KEY"]}
headers["Content-Type"] = "application/json"
r = requests.post("https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/update", headers=headers, json={})
print(r.json())

package main

import (
	"bytes"
	"net/http"
	"os"
)

func main() {
	req, _ := http.NewRequest("POST", "https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/update", bytes.NewBuffer([]byte(`{}`)))
	req.Header.Set("X-API-Key", os.Getenv("ORBIT_API_KEY"))
	req.Header.Set("Content-Type", "application/json")
	http.DefaultClient.Do(req)
}

Ruby

require 'net/http'
require 'json'

uri = URI('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/update')
req = Net::HTTP::Post.new(uri)
req['X-API-Key'] = ENV['ORBIT_API_KEY']
req['Content-Type'] = 'application/json'
req.body = {}.to_json
res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |h| h.request(req) }
puts res.body

PHP

<?php
$ch = curl_init('https://api.orbit.devotel.io/api/v1/public/commerce/acp/{storefrontId}/checkout/update');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
curl_setopt($ch, CURLOPT_HTTPHEADER, [
  'X-API-Key: ' . getenv('ORBIT_API_KEY'),
  'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, <<<JSON
{}
JSON);
echo curl_exec($ch);

{}

API Reference

All Endpoints

Agentic Commerce API

Agentic Commerce API

ACP storefront discovery manifest (public)

ACP hosted product feed (public)

Open a public ACP checkout session

Complete a public ACP checkout under a verified agent mandate

Update a public ACP checkout session

​Agentic Commerce API

​ACP storefront discovery manifest (public)

​ACP hosted product feed (public)

​Open a public ACP checkout session

​Complete a public ACP checkout under a verified agent mandate

​Update a public ACP checkout session

Agentic Commerce API

ACP storefront discovery manifest (public)

ACP hosted product feed (public)

Open a public ACP checkout session

Complete a public ACP checkout under a verified agent mandate

Update a public ACP checkout session