API reference

Sellub exposes two GraphQL APIs from the Vendure server.

Shop API

Public, used by storefronts. Customer-facing operations: browsing products, cart, checkout, account.

• Endpoint: https://api.sellub.com/shop-api
• Auth: vendure-token: <channelToken> header to scope to a shop (the token is the shop’s slug — leave it out for the marketplace); session cookie or the vendure-auth-token header for the customer.
• Schema: introspection is disabled in production. Use a local server (http://localhost:3000/shop-api, with GraphiQL) or @duabalabs/sellub-client’s typed helpers.

Common operations

query GetActiveOrder {
  activeOrder {
    id
    code
    state
    totalWithTax
    lines { productVariant { name } quantity linePriceWithTax }
  }
}
 
mutation AddItemToOrder($variantId: ID!, $quantity: Int!) {
  addItemToOrder(productVariantId: $variantId, quantity: $quantity) {
    ... on Order { id totalQuantity }
    ... on ErrorResult { errorCode message }
  }
}

Admin API

Internal, used by the dashboard and trusted integrations.

• Endpoint: https://api.sellub.com/admin-api
• Auth: an administrator’s session (cookie or vendure-auth-token) or a Vendure API key as Authorization: Bearer <api-key>. Storefront customer sessions are refused.
• Scope: a seller’s account sees only its own shops.
• Schema: as for the Shop API — local only (http://localhost:3000/admin-api).

Common operations

query Orders($options: OrderListOptions) {
  orders(options: $options) {
    items { id code state totalWithTax customer { emailAddress } }
    totalItems
  }
}
 
mutation TransitionOrderToState($id: ID!, $state: String!) {
  transitionOrderToState(id: $id, state: $state) {
    ... on Order { id state }
    ... on OrderStateTransitionError { errorCode transitionError }
  }
}

Custom Sellub APIs

Beyond stock Vendure, Sellub’s plugins add operations. The ones an integrator is most likely to use:

Rate limits

The external-payments REST API is limited to 10 requests a minute per IP and 100 per account. The GraphQL APIs limit query complexity rather than request rate.