GraphQL API

Openship exposes Keystone GraphQL at /api/graphql. The generated schema.graphql includes list operations for shops, channels, orders, items, matches, links and tracking, plus custom product, order, webhook and purchase operations.

Authentication

Dashboard sessions and bearer API keys are present in current source. API keys have hashed secret material, scopes, status, expiry and usage fields. Verify that every operation you expose checks the expected scope and row ownership; a stored scope is not enforcement by itself.

Example: search a shop catalog

The current generated contract accepts shopId and searchEntry and returns a provider-neutral ShopProduct:

query SearchShopProducts($shopId: ID!, $search: String) {
  searchShopProducts(shopId: $shopId, searchEntry: $search) {
    productId
    variantId
    title
    image
    price
    inventory
    inventoryTracked
    availableForSale
    productLink
    error
  }
}

Core custom operations

Current generated names include:

• searchShopProducts, getShopProduct, and searchShopOrders;
• searchChannelProducts and getChannelProduct;
• getShopWebhooks, createShopWebhook, and deleteShopWebhook;
• getChannelWebhooks, createChannelWebhook, and deleteChannelWebhook;
• createChannelPurchase, cancelPurchase, and cancelOrder;
• getMatch, getMatchCount, upsertMatch, overwriteMatch, and matchOrder.

Read exact inputs and result types from schema.graphql. Handler support differs by platform. A generated operation can exist while one adapter returns an error or lacks a production implementation.

Safety checks

Before external access, test missing/expired/wrong-scope keys, cross-user IDs, arbitrary endpoint input, provider timeouts, duplicate purchase retries, webhook signature/replay, redacted errors and cancellation after partial fulfillment.