Vendor API
Authenticated REST API for a single vendor — profile, products, orders, shipments, and bulk import.
The Vendor API is for suppliers integrating with G-Commerce on behalf of one vendor account. Every endpoint requires authentication. Start at Login — your token is saved automatically and reused across all Try it panels.
Getting started
- Log in —
POST /api/v1/auth/loginwith your vendor user credentials. - Session saved — The docs portal stores your
access_tokenfrom the login response. - Call vendor endpoints — Open any page below and click Send request. Your token is pre-filled.
Session bar
Check the toolbar at the top right — it shows whether you are authenticated and which vendor is active. Use Clear to reset the session.
Authentication headers
Every vendor endpoint requires:
| Header | Value |
|---|---|
Authorization | Bearer {access_token} from login |
Vendor context
Your vendor is resolved from the account on your token. There is no vendor header to send, and no vendorId to include in request bodies.
Vendor roles
| Role | Read | Write (create/update/delete) |
|---|---|---|
| OWNER | Yes | Yes |
| ADMIN | Yes | Yes |
| EDITOR | Yes | Yes |
| VIEWER | Yes | No |
Write operations require OWNER, ADMIN, or EDITOR.
Product approval
New products require platform admin approval before they appear on storefronts. Edits to already-live products use a separate staging flow so the storefront keeps showing the current data until an admin approves.
| Action | What happens |
|---|---|
| Create product | Stored as PENDING_APPROVAL until admin publishes |
Update live product (PUBLISHED / HIDDEN) — name, shortDescription, description, or images | Staged in pendingRevision; status stays PUBLISHED; storefront shows live fields |
Update non-live product (PENDING_APPROVAL / DRAFT) — moderated fields | Applied directly to the product row |
| Stock / vendor price (cost) / MSRP / slug / metadata / bulk update | Applied immediately; no re-approval. Customer retail price is derived from vendor price × commission. |
| Bulk upload (feed) | New products start as PENDING_APPROVAL |
Replace images (PUT …/images) | Same staging rules as PATCH images on live products |
Tracking approval:
- First-time publish:
GET /vendor/products?status=PENDING_APPROVALor?needsModeration=trueuntilstatusbecomesPUBLISHED. - Staged live edits:
GET /vendor/products/:id— top-levelname/description/imagesare still live; proposed values are underpendingRevision. Filter with?hasPendingRevision=trueor?needsModeration=true.
The vendor REST API does not accept a status field on create or update.
API sections
All paths use the singular /vendor/ prefix and are scoped to your authenticated vendor.
| Section | Base path | Description |
|---|---|---|
| Profile | /vendor/me/profile | Profile and logo |
| Shipping Methods | /vendor/me/shipping-methods | Shipping options |
| Categories | /vendor/categories | Read-only G-Commerce category trees (lookup IDs for product categoryIds) |
| Products | /vendor/products | Catalog CRUD |
| Bulk Operations | /vendor/products/bulk-* | Bulk update, upload, export |
| Orders | /vendor/orders | Suborder fulfillment |
| Purchase Orders | /vendor/purchase-orders | The same orders priced at your vendor cost |
| Shipments | /vendor/shipments | Tracking and fulfillment |
Base URL: https://api.next.gcommerce.glass/api/v1 (production) or https://sandbox.api.next.gcommerce.glass/api/v1 (local).
Media URLs (images & documents)
Product images, vendor logos, category images, order line imageUrl, and uploaded document paths are returned as absolute public URLs:
{API_ORIGIN}/assets/{storage-path}{API_ORIGIN} is the cockpit host (from GLASS_COCKPIT_URL), e.g. https://api.next.gcommerce.glass or http://localhost:8080 locally.
| Field | Example |
|---|---|
images[].url | {API_ORIGIN}/assets/products/…/images/… |
image (vendor logo) | {API_ORIGIN}/assets/vendors/logos/… |
image (category) | {API_ORIGIN}/assets/categories/… |
items[].imageUrl (orders) | {API_ORIGIN}/assets/products/… |
documents[].document | {API_ORIGIN}/assets/products/…/docs/… |
These links are public (no auth on the image URL). External http(s) URLs are returned unchanged.
How to upload images
| Endpoint | Upload style | Notes |
|---|---|---|
POST /vendor/me/logo | multipart file | Replaces existing logo. Requires OWNER, ADMIN, or EDITOR. |
POST /vendor/products/:id/images | multipart file + optional text fields | Add one image. Staged on live products. Requires OWNER, ADMIN, or EDITOR. |
PUT /vendor/products/:id/images | multipart images files + optional metadata JSON part | Replace full set. Requires OWNER, ADMIN, or EDITOR. |
| Bulk upload | External URL strings (///-separated) | Fetched server-side — not the same as returned /assets/… paths. |
Create/update product JSON bodies do not accept image files — upload images with the endpoints above after the product exists.
Live testing
Each endpoint page has a Try it panel. After logging in once, token and vendor ID flow automatically to every vendor endpoint — no need to copy-paste again. Multipart upload pages are copy-only (use curl).