> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > Never use /api/company/v1 or /api/v1 paths, page/per_page params, or offset pagination — they are legacy. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/auth-v0.yaml covers the unversioned auth surface (/api/... paths — authentication, MFA, social auth, and token exchange); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. # Send magic link > Public, cart-token–scoped. Sends a magic-link / MFA challenge to the customer's `email` and returns a challenge `uuid` (`201`) to submit to `POST …/auth/verify`. No bearer token is required. `fluid_shop` here is the company subdomain (e.g. `acme`). Set `lookup_only: true` for a returning-buyer probe that only looks up an existing customer and never creates one — a `404` then signals the frontend to treat the email as a guest and skip confirmation. Returns `410` when the cart is a locked/authorized enrollment cart and `422` on validation errors. ## OpenAPI ````yaml /api-reference/checkout-v2026-04.yaml post /api/checkout/v2026-04/carts/{cart_token}/auth/magic_link openapi: 3.1.0 info: title: Fluid Checkout API description: >- **Fluid Checkout API — for building a checkout directly against REST.** Use this surface if you are integrating server-to-server or building your own checkout UI. It covers the full order lifecycle (cart → address → shipping → discount → complete → order) plus the logged-in customer's account: saved addresses, saved payment methods, order history, loyalty points, and subscription management (pause, resume, skip, cancel, retry). **The cart token in the URL scopes cart access** — creating a cart, adding items, applying a discount, and completing a cart need no bearer token. Among the cart operations, a Bearer token is required only for `carts/{cart_token}/sync`, `carts/{cart_token}/volume_rep`, and `carts/{cart_token}/discount/manual`. Off the cart, a token is required for everything under `customers/me` and `subscriptions`, and for the store and directory lookups (`store/config`, `store/languages`, `reps`, `users`) and `subscription_bundles`. `store/countries` accepts a token but does not require one — it returns the same list either way. **If you are using the `@fluid-app` FairShare SDK in a theme or storefront, you are not calling this surface** — the SDK calls the Fluid Public SDK API (`public-v2025-06`). Do not mix the two against one cart: they share the same cart records and services, but their request shapes differ. See [Choosing a cart surface](https://docs.fluid.app/api/choosing-a-cart-surface) for the operation map and boundary. version: v2026-04 contact: email: support@fluid.app license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://api.fluid.app security: [] tags: - name: carts description: >- Create, read, and mutate checkout carts (email, address, country, language, shipping, recalculation, completion). - name: cart-auth description: >- Cart-scoped customer authentication — magic-link challenge, verification, identity, and logout. - name: cart-discount description: >- Apply, list, and remove cart discount codes, including admin manual discounts. - name: cart-items description: Add, update, and remove line items on a cart. - name: cart-points description: Apply and remove loyalty points on a cart. - name: customers description: The authenticated customer's profile and company memberships. - name: customer-addresses description: The authenticated customer's saved shipping/billing addresses. - name: customer-orders description: The authenticated customer's order history. - name: customer-payment-methods description: The authenticated customer's saved payment methods and tokenization. - name: customer-points description: The authenticated customer's loyalty point balances. - name: directory description: Company rep and user directory lookups. - name: enrollments description: >- Public enrollment forms — retrieve a form and submit, update, or upload field answers. - name: orders description: Public order lookup by token. - name: products description: Public product queries for the storefront checkout. - name: store description: >- Store-level checkout configuration — countries, languages, address fields, agreements, drop zones, and Apple Pay domain verification. - name: subscriptions description: >- Manage subscriptions — pause, resume, skip, cancel, reactivate, retry, and failed-cycle waivers. - name: subscription-bundles description: List and create subscription bundles. paths: /api/checkout/v2026-04/carts/{cart_token}/auth/magic_link: post: tags: - cart-auth summary: Send magic link description: > Public, cart-token–scoped. Sends a magic-link / MFA challenge to the customer's `email` and returns a challenge `uuid` (`201`) to submit to `POST …/auth/verify`. No bearer token is required. `fluid_shop` here is the company subdomain (e.g. `acme`). Set `lookup_only: true` for a returning-buyer probe that only looks up an existing customer and never creates one — a `404` then signals the frontend to treat the email as a guest and skip confirmation. Returns `410` when the cart is a locked/authorized enrollment cart and `422` on validation errors. operationId: checkout_v2026_04_send_cart_magic_link parameters: - name: cart_token in: path required: true description: Cart token schema: type: string requestBody: content: application/json: examples: send_link: summary: Send a magic-link challenge to a customer email value: email: customer@example.com fluid_shop: acme schema: type: object properties: email: type: string description: Customer email to send magic link to example: customer@example.com fluid_shop: type: string description: Company subdomain example: acme lookup_only: type: boolean description: >- Returning-buyer probe. When true, only looks up an existing customer and never creates one; a not-found (404) tells the frontend to treat the email as a guest and skip the confirmation step. required: - email - fluid_shop additionalProperties: false responses: '201': description: Created content: application/json: schema: $ref: '#/components/schemas/CheckoutCartMagicLinkChallengeResponse' '404': description: >- Cart not found, or (for lookup_only probes) no existing customer for the email — the frontend treats this as a guest and skips the confirmation step content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '410': description: Authorized enrollment cart is locked content: application/json: schema: $ref: '#/components/schemas/LockedCartErrorResponse' '422': description: Unprocessable Entity content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: [] components: schemas: CheckoutCartMagicLinkChallengeResponse: type: object properties: meta: $ref: '#/components/schemas/Meta' multi_factor_authentication: type: object properties: authenticated: type: boolean uuid: type: string verification_channel: type: string verification_code_expires_at: type: string format: date-time required: - authenticated - uuid - verification_channel - verification_code_expires_at additionalProperties: false required: - meta - multi_factor_authentication additionalProperties: false ErrorResponse: type: object additionalProperties: false required: - error_message - errors - meta properties: error_message: type: string errors: $ref: '#/components/schemas/ErrorBag' meta: $ref: '#/components/schemas/CheckoutMeta' LockedCartErrorResponse: type: object additionalProperties: false required: - error_message - errors - meta properties: error_message: type: string errors: $ref: '#/components/schemas/ErrorBag' meta: type: object additionalProperties: false required: - request_id - timestamp - shop_url - cart properties: request_id: type: - string - 'null' timestamp: type: string format: date-time shop_url: type: string cart: 27cf1da2-6873-4170-8369-fa402f6d2870 Meta: type: object properties: request_id: type: - string - 'null' timestamp: type: string format: date-time ErrorBag: description: >- Validation errors keyed by field, a list of errors, a single error message, or null when no structured error details are available. anyOf: - type: string - type: array items: $ref: '#/components/schemas/ErrorValue' - type: object additionalProperties: $ref: '#/components/schemas/ErrorValue' - type: 'null' CheckoutMeta: type: object additionalProperties: false required: - request_id - timestamp properties: request_id: type: - string - 'null' timestamp: type: string format: date-time ErrorValue: description: A validation or API error value. anyOf: - type: string - type: array items: type: string - type: object additionalProperties: $ref: '#/components/schemas/JsonValue' JsonValue: description: >- Any valid JSON value for provider, integration, theme, metadata, or other dynamic payloads whose keys are not fixed by the API contract. anyOf: - type: string - type: number - type: boolean - type: 'null' - type: array items: $ref: '#/components/schemas/JsonValue' - type: object additionalProperties: $ref: '#/components/schemas/JsonValue' ````