API reference
One GraphQL endpoint powers the admin, storefront, and integrations.
The platform exposes a single GraphQL API. Everything the admin UI does is available to you over the same endpoint, scoped by your API key’s organization and permissions. The reference below is generated directly from the live schema (372 queries, 471 mutations, 672 types).
Endpoint
All operations are sent as POST requests to the GraphQL endpoint. In local development that is http://localhost:8080/graphql; in production it is served under your platform host. A GraphQL Playground is available with a GET to the same path.
Authentication & scopes
Server-to-server requests authenticate with an organization API key (wmk_…) sent as Authorization: Bearer wmk_…. Keys are scoped:
products:write— create/update products, attributes, categories.webstore:write— themes, sections, pages, collections, content, translations.settings:write— global settings, commerce toggle, cache, store config.
Browser sessions (the admin UI) authenticate with a session cookie instead. See API keys & scopes.
Errors
Errors follow the GraphQL spec: a top-level errors array with message and extensions (carrying a code such as UNAUTHENTICATED, FORBIDDEN, or NOT_FOUND). A partial data object may be returned alongside field-level errors.
Pagination, filtering & sorting
List queries accept arguments for pagination (page/limit or cursor), a structured filter input, and a sort enum — open a specific query in the reference to see its exact arguments and input types.
Browse the schema
Use the Explorer to run queries live, or browse queries, mutations, and types.
Non-GraphQL endpoints
POST /api/webhooks/stripe/:store_slug— Stripe webhook (per-store HMAC signature).GET /storage/*— product/content media (CDN-cached).GET /internal/*— internal host/domain resolution (shared-secret, not public).GET /health— liveness probe.