API sandbox – Shelf

A path on this site, such as /api/orders. The full address and the docs are in Reference.

Request · headers + body Signed out: {token} stays empty. Sign in {token} = your token

Authorization: Bearer {token}
Content-Type: application/json

Response

Press Send. The status, the time, the x-trace-id header and the body appear here.

Ctrl + Enter (⌘ + Enter on a Mac) runs the query. Examples and the schema: GraphQL explorer.

Query + variables Send my token

query Catalog {
  products(pageSize: 3, sort: PRICE_ASC) {
    total
    items { id name price currency }
  }
}

Response

Run the query. Read both parts of the answer: data and errors.

Addresses

Put the base URL into a Postman variable

Files your lessons ask for

1Read the catalog – no token needed

2Ask as yourself – with the token from “Your access”

3The same catalog through GraphQL – only the fields you ask for

200 read or changed · 201 created, with a Location header · 204 deleted, no body
400 the request breaks a rule – error.details names the field
401 no token or key, or an expired one · 403 signed in, but not allowed
404 not there – or not yours: other students’ data does not exist for you
409 conflicts with the current state · 422 understood, but refused (a coupon, a non-test card)

A query that ran answers 200 – also with errors in the body. Read both data and errors.
A query that cannot run (a typo, an unknown field) answers 400.
extensions.code says what went wrong: UNAUTHENTICATED, NOT_FOUND, BAD_USER_INPUT…
An ID is always a string in GraphQL ("3"); in REST the same id is a number (3). That is by design.

Signed out

Bearer token · 8 hours

–

Header Authorization: Bearer <token>. Anyone with it can act as you until it expires.

API keys

Header X-API-Key: <key>. A key lasts until you revoke it.

Reset my data

Deletes your cart, coupon, orders, payments, products and task progress. Your account and keys stay.

Your last requests from this browser, newest first. Nothing leaves your browser; your token is never kept here.