ShopEazydevelopers
API referenceMerchant API BetaSetup

The setup checklist: the ordered steps from nothing to a live shop

Beta
Credentials
  • OAuth access token
Scopes
store:read
GET
/v1/merchant/stores/{storeId}/setup

Access: OAuth scope store:read; not write-gated.

Authorization

merchantOAuth store:read
headerAuthorizationBearer <token>

OAuth 2.1 (authorization code + PKCE S256, public clients, dynamic registration) for connected AI apps. Effective power is scopes granted AND the person's role today AND the plan. orders:refund, billing:write and team:write are opt-in on the consent screen. Write implies read for marketing:read and messages:read, so a grant holding marketing:write passes a marketing:read check, and messages:send passes messages:read.

Scope: store:read

Path Parameters

storeId*string

A store the person can reach. Any other id answers 404, never 403.

Response Body

OK

application/json
  1. response
data*
Example Request
curl -X GET 'https://api.shopeazy.co/v1/merchant/stores/<storeId>/setup' \  -H 'Authorization: Bearer <access_token>'
Example Response
{  "data": {    "steps": [      {        "key": "agreement",        "done": true,        "why": "The merchant accepts the current Merchant Agreement in the console.",        "tool": "console:/settings/legal"      },      {        "key": "category",        "done": true,        "why": "A shop needs a category before it can go live.",        "tool": "update_store_profile"      },      {        "key": "address",        "done": true,        "why": "Your address goes on your policies, invoices and courier collections.",        "tool": "update_store_profile"      }    ],    "done": 5,    "total": 9  }}

Show or hide a review PUT

A hidden review leaves the shop and the listing's rating; nothing is deleted. Owner or admin. Access: OAuth scope `marketing:write`; write-gated by the subscription.

Collect a setup-checklist credit reward POST

Grants the credits for one finished step of the dashboard's getting-started checklist (`stepKey`). Whether the step is done and the business is eligible is decided again from fresh reads, never from what the caller says. Owner only. Refusals: `not_owner` is 403 `forbidden`; `not_done` (the step is not finished), `already_claimed` and `not_eligible` are 422 `validation_error`, with the reason in `error.details.reason`. Credits are granted once per step per business: the grant is guarded by an entry id inside the credit transaction, so a double tap, a second tab or a retry with a new `Idempotency-Key` answers `already_claimed` and grants nothing. The same key replays the first answer. Access: OAuth scope `settings:write`; owner only (an admin is 403 `forbidden`); write-gated by the subscription.