Test Store Credentials
POST/api/storefront/test-connection
Probe the Store API GET /health with credentials that have not been saved yet. Nothing is persisted, so this is safe to call as often as a form needs it.
This endpoint currently requires session authentication; Personal Access Token scope support is in progress.
Body:
store_url(required, string, max 255) — must be a valid URL AND a bare origin: scheme + host (+ port), no path, query, fragment or credentials, https unless the host is local (localhost, 127.0.0.1, *.localhost, *.test). This is the same rule Create Instance enforces, so a credential pair accepted here can never be refused there.api_key(required, string, min 8, max 255).
200 returns whatever identity and counts the store reported, plus the round-trip time. Fields the store omits come back null and counts comes back {} — a store is free to report as little as it likes.
422 in two shapes: a field error when the address or key is malformed, or {"data": {"ok": false, "error": "…", "status": …}} when the store itself refused — status is the store's HTTP status (401 for a rejected key) or null when the store could not be reached at all.
Permission: integrations.update.
Authentication: Bearer token (session or PAT).
Request
Responses
- 200
- 401
- 403
- 422
- 429
OK
Response Headers
Unauthenticated — the bearer token is missing, revoked, expired, or malformed. Never retry automatically; fix the credential. See the Errors guide.
Forbidden — the token lacks a required scope, the endpoint is not available to API tokens, or the user behind the token lacks the permission. A human must adjust the token scopes or user permissions; do not retry.
Unprocessable Entity
Response Headers
Rate limited — platform limit is 1,000 requests/min; individual tokens may carry lower limits. Honor the Retry-After header before retrying. See the Rate Limits guide.