> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > To sign a new merchant up for Fluid programmatically, call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. The merchant must open the emailed confirmation link, then sign the agent in to the Fluid CLI or give it an API token, before authenticated calls are possible. > After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only on an operation whose spec documents those params — mostly the unversioned company-v0 admin surface, plus some lists on other surfaces, versioned ones included; page every other list with cursors. > Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated except two operations that take no credential, POST /api/company (create a company) and GET /api/agreements/{id} — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country). > api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. > Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other. > For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces. > Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings. > Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties. > Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables. > A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation. > The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations. > Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check. > Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times. # Change a droplet installation > Changes the role or scopes of one of your company's installations. Only the keys you send change. Sending `active: false` then uninstalls it, as `DELETE` does: the droplet's credentials are revoked and its uninstall webhook is sent. Needs the `droplets.update` permission, and `roles.update` to send `role_id`, as assigning a role to a member does. Replaces `PUT /api/droplet_installations/{uuid}`, where `active` was required on every call and `role_id` needed only `droplets.update`. ## OpenAPI ````yaml /api-reference/company-droplets-v2026-10.yaml patch /api/company/v2026-10/droplet-installations/{uuid} openapi: 3.1.0 info: title: Fluid Company API v2026-10 — Droplets version: 2026-10 description: >- Your company's droplets on v2026-10: the catalog your company can install from, the droplets your company publishes, and installing, changing and uninstalling one. ## Authentication Send a company admin credential as `Authorization: Bearer `: an admin session token or an API token for your company. Reads need the `droplets.view` permission; writes and installs need `droplets.update`. Droplet installation tokens are refused, so a droplet cannot rewrite the catalog it is listed in. ## Responses Every response wraps the resource under its own key with `status` and `meta`, in the shape of the v2026-04 storefront API: ```json { "droplet": { "uuid": "drp_…", "title": "Order Sync" }, "status": 200, "meta": { "request_id": "…", "timestamp": "…" } } ``` Errors use the same envelope with `error.message` and field-keyed `error.details`. A 401 is a bare `{ "message": … }`. ## Finding a droplet `GET /droplets?q=…` searches what droplets say they do, so look here before building one. Lists page by cursor: follow `meta.pagination.next_cursor` until it is null. ## Showing installed droplets `GET /droplet-installations` returns every droplet your company has installed with just its uuid, title and logo, for navigation menus and other places shown on every page. Open one with `GET /droplets/{uuid}`. ## Managing an installation `GET /droplet-installations/{uuid}` reads one installation with its droplet, role and scopes. `PATCH` changes its role or scopes, and `DELETE` uninstalls it: the droplet's credentials are revoked and its uninstall webhook is sent. ## Who installed your droplet `GET /droplets/{droplet_uuid}/installations` lists the companies that have installed a droplet your company publishes, each named by its uuid. ## Describing a droplet A droplet is described like the rest of the app's resources: a `title`, a one-line `summary` for its marketplace card, a longer `description` for its details page (HTML: paragraphs, headings, lists, links), a `logo_url`, and `features`, each a `title` with an optional `image_url` or `video_url`. Upload media to your company's DAM first and use the URLs it gives you. ## Checking a droplet's health `GET /droplets/{uuid}/health` says how a droplet's callbacks have behaved for your company's own installation over a trailing window: each callback it answers, whether a checkout waits on it, and its request, failure and timeout counts and latency. Read `metrics_available` first: the figures come from Fluid's monitoring, so they can be missing (`metrics` null, `metrics_error` set) while the installation and its callbacks are listed in full. A zero count is a real reading: nothing called that callback in the window. `installation` is null when your company publishes the droplet but has not installed it. Only your company's installation is ever returned. ## What changed from `/api/droplets` - A droplet is flat: `title`, `summary`, `description`, `logo_url` and `features` replace the `name` and `settings` object, and a feature is its `title` and media. - `filter[ownership]=owned` replaces `GET /api/droplets/company_droplets`. - `publisher` carries the publishing company's `uuid`, not its integer id. - A droplet's installations are read by their own uuid at `/droplet-installations/{uuid}`, and `PATCH` there does not need `active`. - Listing who installed your droplet answers 404, not 401, when the droplet is not your company's. - `PATCH` changes only what you send. - `DELETE` is refused while another company has the droplet installed. - Publishing goes through marketplace review rather than an `active` or `publicly_available` flag. contact: email: support@fluid.app license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://api.fluid.app description: Production API server security: [] tags: - name: droplets description: Droplets your company finds, publishes and installs. x-fluid-section: Droplets paths: /api/company/v2026-10/droplet-installations/{uuid}: parameters: - name: uuid in: path required: true description: The installation's uuid, from `uuid` on an installation. schema: type: string example: dri_7Hc2kWq9mNz4pLx8 patch: tags: - droplets summary: Change a droplet installation description: >- Changes the role or scopes of one of your company's installations. Only the keys you send change. Sending `active: false` then uninstalls it, as `DELETE` does: the droplet's credentials are revoked and its uninstall webhook is sent. Needs the `droplets.update` permission, and `roles.update` to send `role_id`, as assigning a role to a member does. Replaces `PUT /api/droplet_installations/{uuid}`, where `active` was required on every call and `role_id` needed only `droplets.update`. operationId: companyDropletInstallationUpdate requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/CompanyDropletInstallationUpdateRequest' examples: scopes: summary: Narrow the scopes value: installation: scopes: - orders role: summary: Change the role value: installation: role_id: 4182 responses: '200': description: Updated, or uninstalling when `active` was false. content: application/json: schema: $ref: '#/components/schemas/CompanyDropletInstallationResponse' example: droplet_installation: uuid: dri_7Hc2kWq9mNz4pLx8 droplet_uuid: drp_4tq8nxw2kfl9mrv3bpz6cyh1jds7age5 droplet: uuid: drp_4tq8nxw2kfl9mrv3bpz6cyh1jds7age5 title: Order Sync logo_url: https://ik.imagekit.io/fluid/droplets/order-sync/logo.png status: active role: id: 4182 name: Order Sync scopes: - orders effective_scopes: - orders created_at: '2026-10-18T15:32:08Z' updated_at: '2026-10-20T15:32:08Z' status: 200 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-20T15:32:08Z' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': description: >- No installation of your company by that uuid. Another company's installation reads as missing. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Droplet installation not found details: {} status: 404 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-20T15:32:08Z' '422': description: >- Invalid parameters, a role your company does not have, or scopes the droplet may not request. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Role not found details: role_id: - not found status: 422 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-20T15:32:08Z' security: - bearer_auth: [] components: schemas: CompanyDropletInstallationUpdateRequest: type: object required: - installation properties: installation: type: object description: Only the keys sent change. properties: role_id: type: - integer - 'null' description: The role the droplet acts with. Null clears it. scopes: type: array items: type: string description: >- Scopes to grant, within what the droplet requests. Replaces the list. active: type: boolean description: >- `false` uninstalls an active installation after any other change is saved, as `DELETE` does. `true` changes nothing: an installation being removed cannot be reactivated. CompanyDropletInstallationResponse: type: object description: One installation. required: - droplet_installation - status - meta properties: droplet_installation: $ref: '#/components/schemas/CompanyDropletInstallation' status: type: integer meta: $ref: '#/components/schemas/Meta' ErrorResponse: type: object required: - error - status - meta properties: error: type: object required: - message properties: message: type: string details: type: object additionalProperties: true status: type: integer meta: $ref: '#/components/schemas/Meta' CompanyDropletInstallation: type: object required: - uuid - droplet_uuid - droplet - status - scopes - effective_scopes - created_at - updated_at properties: uuid: type: string description: The installation's public identifier. droplet_uuid: type: string droplet: type: object description: The droplet installed. required: - uuid - title - logo_url properties: uuid: type: string title: type: - string - 'null' logo_url: type: - string - 'null' role: description: >- The role the droplet acts with, or null. Present only when you have the `roles.view` permission. oneOf: - type: 'null' - type: object required: - id - name properties: id: type: integer name: type: - string - 'null' status: type: string enum: - active - pending_uninstall - uninstalled scopes: type: array items: type: string description: The scopes granted. effective_scopes: type: array items: type: string description: >- The scopes in force: those granted, within what the droplet may request. created_at: type: string format: date-time description: When it was installed. updated_at: type: string format: date-time Meta: type: object description: | Response metadata included on every successful response body. `request_id` and `timestamp` are always present; list endpoints also add `pagination`. required: - request_id - timestamp properties: request_id: type: - string - 'null' timestamp: type: string format: date-time pagination: $ref: '#/components/schemas/Pagination' UnauthorizedError: type: object description: | Bare 401 body — a single `message` string, not the wrapped `ErrorResponse`. required: - message properties: message: type: string example: Invalid credentials. ForbiddenError: description: | Bare 403 body: `{ error }` when a storefront permission is missing, or `{ message }` when the credential is not company-admin tier. oneOf: - type: object required: - error properties: error: type: string example: Not authorized. - type: object required: - message properties: message: type: string example: Not authorized. Pagination: type: object required: - cursor - limit - prev_cursor - next_cursor properties: cursor: type: - string - 'null' limit: type: integer example: 25 prev_cursor: type: - string - 'null' next_cursor: type: - string - 'null' responses: Unauthorized: description: >- Missing or invalid bearer token. The body is a bare `{ message }`, not the error envelope. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' example: message: Invalid credentials. Forbidden: description: >- Authenticated, but not a company admin with the needed droplets permission, or a droplet installation token. The body is bare. content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' example: message: Not authorized. securitySchemes: bearer_auth: type: http scheme: bearer description: >- A company admin credential for your company. Droplet installation tokens are refused. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.