Admin API

Files

Uploaded images and the files buyers download.

GETUploaded files, newest first
POSTStart uploading a file; send it in parts, then complete
POSTJoin the parts into the file and record its SHA-256
POSTSend one part (base64, at most part_size bytes before encoding)
GETFiles a buyer gets with this product
POSTGive buyers of this product a file
DELStop giving this file with the product (existing download links keep working)

Uploaded files, newest first

GET/admin/2026-11/files

scope read_files

Query parameters

limitinteger
Items per page, 1 to 250.
Default 50 · 1 to 250
afterstring
Cursor from a previous next_cursor.
Up to 512 characters

Response 200

dataarray of objectrequired
data[].idID (fil_...)required
data[].namestringrequired
data[].content_typestringrequired
data[].sizeintegerrequired
data[].sha256stringrequired
data[].created_attimestamprequired
has_morebooleanrequired
next_cursorstring or nullrequired

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl https://api.storelyne.com/admin/2026-11/files \
  -H "Authorization: Bearer pat_live_..."

const res = await fetch('https://api.storelyne.com/admin/2026-11/files', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
  },
});
const data = await res.json();

Response 200

{
  "data": [
    {
      "id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
      "name": "Festive saree",
      "content_type": "string",
      "size": 1,
      "sha256": "string",
      "created_at": "2026-11-04T10:00:00.000Z"
    }
  ],
  "has_more": false,
  "next_cursor": "eyJpZCI6Ii4uLiJ9"
}

Start uploading a file; send it in parts, then complete

POST/admin/2026-11/files/uploads

scope write_filesIdempotency-Key required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Request body

sizeintegerrequired
Up to 52428800

Response 201

upload_idID (fil_...)required
part_sizeintegerrequired
partsintegerrequired

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/files/uploads \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "size": 1
}'

const res = await fetch('https://api.storelyne.com/admin/2026-11/files/uploads', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "size": 1
  }),
});
const data = await res.json();

Response 201

{
  "upload_id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
  "part_size": 1,
  "parts": 1
}

Join the parts into the file and record its SHA-256

POST/admin/2026-11/files/uploads/{id}/complete

scope write_filesIdempotency-Key required

Path parameters

idID (fil_...)required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Request body

namestringrequired
At least 1 characters · Up to 200 characters
content_typestringrequired
At least 3 characters · Up to 100 characters
partsintegerrequired
1 to 100

Response 201

idID (fil_...)required
namestringrequired
content_typestringrequired
sizeintegerrequired
sha256stringrequired
created_attimestamprequired

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
409	`conflict`	The request conflicts with the current state of the object.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/files/uploads/fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R/complete \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "Festive saree",
  "content_type": "string",
  "parts": 1
}'

const res = await fetch('https://api.storelyne.com/admin/2026-11/files/uploads/fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R/complete', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "name": "Festive saree",
    "content_type": "string",
    "parts": 1
  }),
});
const data = await res.json();

Response 201

{
  "id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
  "name": "Festive saree",
  "content_type": "string",
  "size": 1,
  "sha256": "string",
  "created_at": "2026-11-04T10:00:00.000Z"
}

Send one part (base64, at most part_size bytes before encoding)

POST/admin/2026-11/files/uploads/{id}/parts

scope write_filesIdempotency-Key required

Path parameters

idID (fil_...)required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Request body

indexintegerrequired
0 to 99
data_base64stringrequired
At least 1 characters · Up to 1000000 characters

Response 200

indexintegerrequired
bytesintegerrequired

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/files/uploads/fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R/parts \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "index": 1,
  "data_base64": "string"
}'

const res = await fetch('https://api.storelyne.com/admin/2026-11/files/uploads/fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R/parts', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "index": 1,
    "data_base64": "string"
  }),
});
const data = await res.json();

Response 200

{
  "index": 1,
  "bytes": 1
}

Files a buyer gets with this product

GET/admin/2026-11/products/{id}/files

scope read_files

Path parameters

idID (prd_...)required

Response 200

dataarray of objectrequired
data[].idID (fil_...)required
data[].namestringrequired
data[].content_typestringrequired
data[].sizeintegerrequired
data[].sha256stringrequired
data[].created_attimestamprequired

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl https://api.storelyne.com/admin/2026-11/products/prd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/files \
  -H "Authorization: Bearer pat_live_..."

const res = await fetch('https://api.storelyne.com/admin/2026-11/products/prd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/files', {
  method: 'GET',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
  },
});
const data = await res.json();

Response 200

{
  "data": [
    {
      "id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
      "name": "Festive saree",
      "content_type": "string",
      "size": 1,
      "sha256": "string",
      "created_at": "2026-11-04T10:00:00.000Z"
    }
  ]
}

Give buyers of this product a file

POST/admin/2026-11/products/{id}/files

scope write_filesscope write_productsIdempotency-Key required

Path parameters

idID (prd_...)required

Headers

Idempotency-Keystringrequired
Unique key for this request. Retries with the same key return the first response.
At least 1 characters · Up to 255 characters
X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Request body

file_idID (fil_...)required

Response 200

dataarray of objectrequired
data[].idID (fil_...)required
data[].namestringrequired
data[].content_typestringrequired
data[].sizeintegerrequired
data[].sha256stringrequired
data[].created_attimestamprequired

Errors

400	`idempotency_key_required`	Every POST needs an Idempotency-Key header.
400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
409	`idempotency_in_progress`	A request with this Idempotency-Key is still running.
422	`idempotency_key_reused`	This Idempotency-Key was used with a different request.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X POST https://api.storelyne.com/admin/2026-11/products/prd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/files \
  -H "Authorization: Bearer pat_live_..." \
  -H "Idempotency-Key: $(uuidgen)" \
  -H "Content-Type: application/json" \
  -d '{
  "file_id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R"
}'

const res = await fetch('https://api.storelyne.com/admin/2026-11/products/prd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/files', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
    'Idempotency-Key': crypto.randomUUID(),
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    "file_id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R"
  }),
});
const data = await res.json();

Response 200

{
  "data": [
    {
      "id": "fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R",
      "name": "Festive saree",
      "content_type": "string",
      "size": 1,
      "sha256": "string",
      "created_at": "2026-11-04T10:00:00.000Z"
    }
  ]
}

Stop giving this file with the product (existing download links keep working)

DEL/admin/2026-11/products/{id}/files/{file_id}

scope write_filesscope write_products

Path parameters

idID (prd_...)required
file_idID (fil_...)required

Headers

X-CSRF-Tokenstring
Required with a seller session cookie: the value of the orb_csrf cookie.

Response 204

No body.

Errors

400	`validation_failed`	A field in the request is missing or invalid. See param.
401	`authentication_required`	Send a valid access token or session.
403	`missing_scope`	The app token does not have the scope this endpoint needs.
404	`resource_not_found`	The object does not exist or belongs to another store.
429	`rate_limited`	Too many requests. Wait for the time in RateLimit-Reset.
500	`internal_error`	Something went wrong on our side. Quote the trace_id to support.

curl -X DELETE https://api.storelyne.com/admin/2026-11/products/prd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/files/fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R \
  -H "Authorization: Bearer pat_live_..."

const res = await fetch('https://api.storelyne.com/admin/2026-11/products/prd_01JCG8ZQ5S7T0V4X8K2M3N6P9R/files/fil_01JCG8ZQ5S7T0V4X8K2M3N6P9R', {
  method: 'DELETE',
  headers: {
    'Authorization': `Bearer ${process.env.STORELYNE_TOKEN}`,
  },
});
const data = await res.json();

Response 204

No body.