Wocart API
Complete reference for the Wocart REST API: merchant endpoints under /api, storefront endpoints under /store, plus images and webhooks.
Authentication
Merchant endpoints accept X-API-Key or Authorization: Bearer <JWT>. Public storefront endpoints use X-Store-API-Key. Operations that require a scheme list it.
Read Authentication for keys, scopes and failure modes, and Errors for the error envelope and retry guidance.
Responses
JSON operations wrap their payload as { "success": true, "data": ... }. List endpoints add a count; a few paginated lists use total instead. Image endpoints return binary data and webhook endpoints answer carrier-specific payloads. Each operation's response schema is authoritative.
An order was placed: on the store, in the dashboard, through the API or by an AI agent.
An order's customer, destination or notes were edited.
The customer confirmed the order, usually on the phone.
The customer could not be reached to confirm the order.
The order is being prepared.
The order is packed and ready to hand to delivery.
The order was cancelled.
Units of an order line were refused at the door and came back.
The order was deleted; the event carries it as it was.
The order was handed to a carrier or to one of the store's drivers.
The parcel left for the customer.
An attempt to deliver the parcel failed.
The parcel was delivered and paid for on delivery.
The parcel is on its way back to the store.
The parcel is back with the store.
The shipment was cancelled before it was delivered.
The handoff was undone: the order is no longer with delivery.