> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > To sign a new merchant up for Fluid programmatically, call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. Before authenticated calls are possible, the merchant must sign the agent in to the Fluid CLI with the emailed code and --shop set to the company's fluid_shop (which also confirms the signup), or open the emailed confirmation link and give the agent an API token. > After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only on an operation whose spec documents those params — mostly the unversioned company-v0 admin surface, plus some lists on other surfaces, versioned ones included; page every other list with cursors. > Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated except two operations that take no credential, POST /api/company (create a company) and GET /api/agreements/{id} — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country). > api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. > Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other. > For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces. > Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings. > Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties. > Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables. > A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation. > The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations. > Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check. > Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times. # Ask Fluid to publish a droplet > Asks Fluid to put a draft or internal droplet your company publishes in the public marketplace. Fluid's reviewers are told; the droplet keeps its status, and keeps working for the stores that use it, until a reviewer decides. Approving publishes it. Rejecting leaves it as it is, and the requester is emailed why; the reason also shows in the droplet's `latest_publish_review`. Asking while a request already waits returns that request with 200 and tells no one again; a new request is 201. A droplet that is published, suspended or archived cannot ask (409). Another company's droplet, and every droplet while `publish_review_available` is false, is a 404. Needs the `droplets.update` permission. ## OpenAPI ````yaml /api-reference/company-droplets-v2026-10.yaml post /api/company/v2026-10/droplets/{droplet_uuid}/publish-request openapi: 3.1.0 info: title: Fluid Company API v2026-10 — Droplets version: 2026-10 description: >- Your company's droplets on v2026-10: the catalog your company can install from, the droplets your company publishes, and installing, changing and uninstalling one. ## Authentication Send a company admin credential as `Authorization: Bearer `: an admin session token or an API token for your company. Reads need the `droplets.view` permission; writes and installs need `droplets.update`. Droplet installation tokens are refused, so a droplet cannot rewrite the catalog it is listed in. ## Responses Every response wraps the resource under its own key with `status` and `meta`, in the shape of the v2026-04 storefront API: ```json { "droplet": { "uuid": "drp_…", "title": "Order Sync" }, "status": 200, "meta": { "request_id": "…", "timestamp": "…" } } ``` Errors use the same envelope with `error.message` and field-keyed `error.details`. A 401 is a bare `{ "message": … }`. ## Finding a droplet `GET /droplets?q=…` searches what droplets say they do, so look here before building one. Lists page by cursor: follow `meta.pagination.next_cursor` until it is null. ## Showing installed droplets `GET /droplet-installations` returns every droplet your company has installed with just its uuid, title and logo, for navigation menus and other places shown on every page. Open one with `GET /droplets/{uuid}`. ## Managing an installation `GET /droplet-installations/{uuid}` reads one installation with its droplet, role and scopes. `PATCH` changes its role or scopes, and `DELETE` uninstalls it: the droplet's credentials are revoked and its uninstall webhook is sent. ## Who installed your droplet `GET /droplets/{droplet_uuid}/installations` lists the companies that have installed a droplet your company publishes, each named by its uuid. ## Describing a droplet A droplet is described like the rest of the app's resources: a `title`, a one-line `summary` for its marketplace card, a longer `description` for its details page (HTML: paragraphs, headings, lists, links), a `logo_url`, and `features`, each a `title` with an optional `image_url` or `video_url`. Upload media to your company's DAM first and use the URLs it gives you. ## Publishing a droplet Only Fluid publishes a droplet to the public marketplace. When a draft or internal droplet is ready, `POST /droplets/{droplet_uuid}/publish-request` asks Fluid to review it; the droplet keeps its status, and keeps working for the stores that use it, until Fluid decides. Asking again while a request waits returns the same request, and `DELETE` withdraws it. Fluid publishes the droplet when it approves, or emails why it didn't; `latest_publish_review` on the droplet shows where the request stands, with the reason once rejected. Every move back to the marketplace, such as after Fluid unlists a droplet, is asked for the same way. Check `publish_review_available` first: while it is false, these endpoints answer 404. ## Webhook secret Fluid signs the webhooks and data requests it sends your droplet with its webhook secret. No droplet response carries it. `POST /droplets/{uuid}/webhook-secret-rotations` generates a new one and returns it once; the old one stops being used immediately. ## Checking a droplet's health `GET /droplets/{uuid}/health` says how a droplet's callbacks have behaved for your company's own installation over a trailing window: each callback it answers, whether a checkout waits on it, and its request, failure and timeout counts and latency. Read `metrics_available` first: the figures come from Fluid's monitoring, so they can be missing (`metrics` null, `metrics_error` set) while the installation and its callbacks are listed in full. A zero count is a real reading: nothing called that callback in the window. `installation` is null when your company publishes the droplet but has not installed it. Only your company's installation is ever returned. ## What changed from `/api/droplets` - A droplet is flat: `title`, `summary`, `description`, `logo_url` and `features` replace the `name` and `settings` object, and a feature is its `title` and media. - `filter[ownership]=owned` replaces `GET /api/droplets/company_droplets`. - `publisher` carries the publishing company's `uuid`, not its integer id. - A droplet's installations are read by their own uuid at `/droplet-installations/{uuid}`, and `PATCH` there does not need `active`. - Listing who installed your droplet answers 404, not 401, when the droplet is not your company's. - `PATCH` changes only what you send. - `status` replaces the `active` and `publicly_available` flags, with the same rules: anyone with `droplets.update` can take a droplet offline (`draft`) or back into service (`internal`); publishing, or unlisting a published droplet, needs a Fluid root admin. - `DELETE` is refused while another company has the droplet installed. - Publishing goes through marketplace review (`POST /droplets/{droplet_uuid}/publish-request`) rather than an `active` or `publicly_available` flag. contact: email: support@fluid.app license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://api.fluid.app description: Production API server security: [] tags: - name: droplets description: Droplets your company finds, publishes and installs. x-fluid-section: Droplets paths: /api/company/v2026-10/droplets/{droplet_uuid}/publish-request: parameters: - name: droplet_uuid in: path required: true description: The uuid of a draft or internal droplet your company publishes. schema: type: string example: drp_9xk2mt7pq4rz1bwc8hd5nfy3jvs6ale0 post: tags: - droplets summary: Ask Fluid to publish a droplet description: >- Asks Fluid to put a draft or internal droplet your company publishes in the public marketplace. Fluid's reviewers are told; the droplet keeps its status, and keeps working for the stores that use it, until a reviewer decides. Approving publishes it. Rejecting leaves it as it is, and the requester is emailed why; the reason also shows in the droplet's `latest_publish_review`. Asking while a request already waits returns that request with 200 and tells no one again; a new request is 201. A droplet that is published, suspended or archived cannot ask (409). Another company's droplet, and every droplet while `publish_review_available` is false, is a 404. Needs the `droplets.update` permission. operationId: companyDropletPublishRequestCreate responses: '200': description: The request already waiting. content: application/json: schema: $ref: '#/components/schemas/CompanyDropletPublishRequestResponse' example: publish_request: id: 01a1507c-2222-7333-8444-555566667777 state: pending status_before: internal reason: null requested_at: '2026-10-21T18:04:12Z' decided_at: null status: 200 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-21T18:10:40Z' '201': description: The new request. content: application/json: schema: $ref: '#/components/schemas/CompanyDropletPublishRequestResponse' example: publish_request: id: 01a1507c-2222-7333-8444-555566667777 state: pending status_before: internal reason: null requested_at: '2026-10-21T18:04:12Z' decided_at: null status: 201 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-21T18:04:12Z' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '409': description: The droplet is not draft or internal. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Only a draft or internal droplet can ask to be published details: status: - is published status: 409 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-21T18:04:12Z' security: - bearer_auth: [] components: schemas: CompanyDropletPublishRequestResponse: type: object description: One request to publish a droplet. required: - publish_request - status - meta properties: publish_request: $ref: '#/components/schemas/CompanyDropletPublishRequest' status: type: integer meta: $ref: '#/components/schemas/Meta' ErrorResponse: type: object required: - error - status - meta properties: error: type: object required: - message properties: message: type: string details: type: object additionalProperties: true status: type: integer meta: $ref: '#/components/schemas/Meta' CompanyDropletPublishRequest: type: object description: A request for Fluid to publish the droplet to the public marketplace. required: - id - state - status_before - reason - requested_at - decided_at properties: id: type: string format: uuid state: type: string enum: - pending - approved - rejected - withdrawn - superseded description: >- `pending` waits on Fluid. `approved` published the droplet; `rejected` left it as it was, with `reason`. `withdrawn` you took back, and `superseded` Fluid settled another way, such as publishing or suspending the droplet directly. status_before: type: string enum: - draft - internal description: The droplet's status when it asked. reason: type: - string - 'null' description: Why Fluid did not publish it; null unless rejected. requested_at: type: string format: date-time decided_at: type: - string - 'null' format: date-time description: >- When it was approved, rejected, withdrawn or superseded; null while pending. Meta: type: object description: | Response metadata included on every successful response body. `request_id` and `timestamp` are always present; list endpoints also add `pagination`. required: - request_id - timestamp properties: request_id: type: - string - 'null' timestamp: type: string format: date-time pagination: $ref: '#/components/schemas/Pagination' UnauthorizedError: type: object description: | Bare 401 body — a single `message` string, not the wrapped `ErrorResponse`. required: - message properties: message: type: string example: Invalid credentials. ForbiddenError: description: | Bare 403 body: `{ error }` when a storefront permission is missing, or `{ message }` when the credential is not company-admin tier. oneOf: - type: object required: - error properties: error: type: string example: Not authorized. - type: object required: - message properties: message: type: string example: Not authorized. Pagination: type: object required: - cursor - limit - prev_cursor - next_cursor properties: cursor: type: - string - 'null' limit: type: integer example: 25 prev_cursor: type: - string - 'null' next_cursor: type: - string - 'null' responses: Unauthorized: description: >- Missing or invalid bearer token. The body is a bare `{ message }`, not the error envelope. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' example: message: Invalid credentials. Forbidden: description: >- Authenticated, but not a company admin with the needed droplets permission, or a droplet installation token. The body is bare. content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' example: message: Not authorized. NotFound: description: >- No such droplet for your company. Another company's private droplet, and on writes another company's droplet of any status, read as missing. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Droplet not found details: {} status: 404 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-18T15:32:08Z' securitySchemes: bearer_auth: type: http scheme: bearer description: >- A company admin credential for your company. Droplet installation tokens are refused. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.