The REST and GraphQL API, route by route

Base URL, auth and response shape

Routes marked session sit behind the userAuth authorizer: send the JWT from POST /login as a bearer token. It carries the user and business, and every session route is scoped to that business. Per-business API keys are created and rotated through the GraphQL apiKeys mutations. Routes marked public need no token and are either called by a platform (webhooks, OAuth callbacks), by the widget, or are read-only feeds keyed by your public business GUID (bguid).

// 200
{ "status": true, "result": { … } }

// 4xx / 5xx
{ "status": false, "message": "anchorId is required" }

Operational errors are typed: 400 bad request, 401 unauthorised, 403 forbidden, 404 not found, 409 conflict, 422 validation. Anything else is a 500 with a correlation id in the logs.

Three calls to start with

# Product-tagged posts for email (Klaviyo data feed)
curl "https://api.idukki.io/webfeed/YOUR_BGUID?limit=12"

# Aggregate rating for one product (null ratingValue when nothing is rated)
curl "https://api.idukki.io/webfeed/YOUR_BGUID/rating?productId=SHOPIFY_PRODUCT_ID"

# Agent-readable feed: products + rights-cleared UGC + reviews
curl "https://api.idukki.io/agent-feed/YOUR_BGUID?limit=50&ugc=6"

TOKEN=$(curl -s -X POST https://api.idukki.io/login \
  -H 'content-type: application/json' \
  -d '{"email":"you@example.com","password":"…"}' | jq -r .result.token)

curl "https://api.idukki.io/gallery-layouts" -H "authorization: Bearer $TOKEN"

Routes

Grouped by what you would use them for. Tags are the serverless function domains; the summary column is whatever the spec carries for the route, so a bare domain name means nobody has written a per-route summary yet.

Not listed: 38 operations under internal tags (admin proxy, cron triggers, health probes, SSO, email service, Stripe and Resend receivers). They are in the spec but are not a surface to build on.