> ## Documentation Index > Fetch the complete documentation index at: https://docs.fluid.app/llms.txt > Use this file to discover all available pages before exploring further. > ## Agent Instructions > For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract. > Authenticate with the header Authorization: Bearer ; public storefront read endpoints require no auth. > To sign a new merchant up for Fluid programmatically, call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. The merchant must open the emailed confirmation link, then sign the agent in to the Fluid CLI or give it an API token, before authenticated calls are possible. > After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch. > Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null. > When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only on an operation whose spec documents those params — mostly the unversioned company-v0 admin surface, plus some lists on other surfaces, versioned ones included; page every other list with cursors. > Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile. > The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated except two operations that take no credential, POST /api/company (create a company) and GET /api/agreements/{id} — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country). > api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract). > Successful responses wrap the resource payload alongside a top-level integer status and a meta object. > Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other. > For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces. > Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings. > Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties. > Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables. > A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation. > The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations. > Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check. > Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times. # Check a droplet's health > How the droplet's callbacks have behaved for your company's own installation over a trailing window, and where it sits relative to a checkout. Use it to see whether a droplet is slowing or failing checkouts. Read `metrics_available` first. When it is false the callbacks are still listed, with `metrics` null and `metrics_error.type` saying why. A droplet your company neither publishes nor has installed is a 404. Needs the `developer.view` permission. ## OpenAPI ````yaml /api-reference/company-droplets-v2026-10.yaml get /api/company/v2026-10/droplets/{uuid}/health openapi: 3.1.0 info: title: Fluid Company API v2026-10 — Droplets version: 2026-10 description: >- Your company's droplets on v2026-10: the catalog your company can install from, the droplets your company publishes, and installing one. ## Authentication Send a company admin credential as `Authorization: Bearer `: an admin session token or an API token for your company. Reads need the `droplets.view` permission; writes and installs need `droplets.update`. Droplet installation tokens are refused, so a droplet cannot rewrite the catalog it is listed in. ## Responses Every response wraps the resource under its own key with `status` and `meta`, in the shape of the v2026-04 storefront API: ```json { "droplet": { "uuid": "drp_…", "title": "Order Sync" }, "status": 200, "meta": { "request_id": "…", "timestamp": "…" } } ``` Errors use the same envelope with `error.message` and field-keyed `error.details`. A 401 is a bare `{ "message": … }`. ## Finding a droplet `GET /droplets?q=…` searches what droplets say they do, so look here before building one. Lists page by cursor: follow `meta.pagination.next_cursor` until it is null. ## Showing installed droplets `GET /droplet-installations` returns every droplet your company has installed with just its uuid, title and logo, for navigation menus and other places shown on every page. Open one with `GET /droplets/{uuid}`. ## Describing a droplet A droplet is described like the rest of the app's resources: a `title`, a one-line `summary` for its marketplace card, a longer `description` for its details page (HTML: paragraphs, headings, lists, links), a `logo_url`, and `features`, each a `title` with an optional `image_url` or `video_url`. Upload media to your company's DAM first and use the URLs it gives you. ## Checking a droplet's health `GET /droplets/{uuid}/health` says how a droplet's callbacks have behaved for your company's own installation over a trailing window: each callback it answers, whether a checkout waits on it, and its request, failure and timeout counts and latency. Read `metrics_available` first: the figures come from Fluid's monitoring, so they can be missing (`metrics` null, `metrics_error` set) while the installation and its callbacks are listed in full. A zero count is a real reading: nothing called that callback in the window. `installation` is null when your company publishes the droplet but has not installed it. Only your company's installation is ever returned. ## What changed from `/api/droplets` - A droplet is flat: `title`, `summary`, `description`, `logo_url` and `features` replace the `name` and `settings` object, and a feature is its `title` and media. - `filter[ownership]=owned` replaces `GET /api/droplets/company_droplets`. - `PATCH` changes only what you send. - `DELETE` is refused while another company has the droplet installed. - Publishing goes through marketplace review rather than an `active` or `publicly_available` flag. contact: email: support@fluid.app license: name: Proprietary identifier: LicenseRef-Proprietary servers: - url: https://api.fluid.app description: Production API server security: [] tags: - name: droplets description: Droplets your company finds, publishes and installs. x-fluid-section: Droplets paths: /api/company/v2026-10/droplets/{uuid}/health: parameters: - name: uuid in: path required: true description: The droplet's uuid, from `uuid` on any droplet. schema: type: string example: drp_4tq8nxw2kfl9mrv3bpz6cyh1jds7age5 get: tags: - droplets summary: Check a droplet's health description: >- How the droplet's callbacks have behaved for your company's own installation over a trailing window, and where it sits relative to a checkout. Use it to see whether a droplet is slowing or failing checkouts. Read `metrics_available` first. When it is false the callbacks are still listed, with `metrics` null and `metrics_error.type` saying why. A droplet your company neither publishes nor has installed is a 404. Needs the `developer.view` permission. operationId: companyDropletHealth parameters: - name: window_hours in: query required: false description: The trailing window in hours, 1 to 168. Defaults to 24. schema: type: integer minimum: 1 maximum: 168 example: 24 responses: '200': description: The droplet's health for your company. content: application/json: schema: $ref: '#/components/schemas/CompanyDropletHealthResponse' example: droplet_health: window_hours: 24 generated_at: '2026-10-18T15:32:08Z' metrics_available: true metrics_error: null droplet: uuid: drp_4tq8nxw2kfl9mrv3bpz6cyh1jds7age5 name: Taxify status: published installation: installation_uuid: dri_7hq2mxk4bnv8rlp3ctw6yzd1fgs9aje5 installation_status: active scopes: - main classification: criticality: checkout_blocking domains: - cart checkout_path: true commerce_access: false blocking: true reasons: - answers update_cart_tax (checkout_blocking) metrics: request_count: 1840 failure_count: 23 timeout_count: 9 failure_rate: 0.0125 average_ms: 182.4 worst_p95_ms: 640 max_ms: 3012 registrations: - uuid: 0199e0a4-5c1f-7b42-9a3e-2d6f8c1b4e70 definition_name: update_cart_tax criticality: checkout_blocking domain: cart url: https://taxify.example.com/fluid/callbacks/tax active: true country_codes: [] metrics: request_count: 1840 failure_count: 23 timeout_count: 9 failure_rate: 0.0125 average_ms: 182.4 worst_p95_ms: 640 max_ms: 3012 status: 200 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-18T15:32:08Z' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' security: - bearer_auth: [] components: schemas: CompanyDropletHealthResponse: type: object description: A droplet's health for your company's installation. required: - droplet_health - status - meta properties: droplet_health: $ref: '#/components/schemas/CompanyDropletHealth' status: type: integer meta: $ref: '#/components/schemas/Meta' CompanyDropletHealth: type: object required: - window_hours - generated_at - metrics_available - metrics_error - droplet - installation properties: window_hours: type: integer description: The trailing window the figures cover, in hours. generated_at: type: string format: date-time description: When the figures were read. Readings are reused for up to a minute. metrics_available: type: boolean description: >- Whether the callback figures could be read. When false, every `metrics` is null and `metrics_error` says why. metrics_error: description: Why the figures are missing or partial, or null. oneOf: - type: 'null' - $ref: '#/components/schemas/CompanyDropletHealthMetricsError' droplet: type: object required: - uuid - name - status properties: uuid: type: string name: type: - string - 'null' status: type: string installation: description: >- Your company's active installation of the droplet, or null when it has none. oneOf: - type: 'null' - $ref: '#/components/schemas/CompanyDropletHealthInstallation' Meta: type: object description: | Response metadata included on every successful response body. `request_id` and `timestamp` are always present; list endpoints also add `pagination`. required: - request_id - timestamp properties: request_id: type: - string - 'null' timestamp: type: string format: date-time pagination: $ref: '#/components/schemas/Pagination' UnauthorizedError: type: object description: | Bare 401 body — a single `message` string, not the wrapped `ErrorResponse`. required: - message properties: message: type: string example: Invalid credentials. ForbiddenError: description: | Bare 403 body: `{ error }` when a storefront permission is missing, or `{ message }` when the credential is not company-admin tier. oneOf: - type: object required: - error properties: error: type: string example: Not authorized. - type: object required: - message properties: message: type: string example: Not authorized. ErrorResponse: type: object required: - error - status - meta properties: error: type: object required: - message properties: message: type: string details: type: object additionalProperties: true status: type: integer meta: $ref: '#/components/schemas/Meta' CompanyDropletHealthMetricsError: type: object required: - type - description properties: type: type: string enum: - unavailable - incomplete description: >- `unavailable`: the figures could not be read; try again in a few minutes. `incomplete`: the window was read but may be missing some callbacks. description: type: string description: A fixed plain-language sentence for the type. CompanyDropletHealthInstallation: type: object required: - installation_uuid - installation_status - scopes - classification - metrics - registrations properties: installation_uuid: type: string installation_status: type: string scopes: type: array items: type: string description: The API scopes the installation holds. classification: $ref: '#/components/schemas/CompanyDropletHealthClassification' metrics: description: >- Every callback of the installation together. Null when the figures could not be read. oneOf: - type: 'null' - $ref: '#/components/schemas/CompanyDropletHealthMetrics' registrations: type: array description: The callbacks the droplet answers for your company. items: $ref: '#/components/schemas/CompanyDropletHealthRegistration' Pagination: type: object required: - cursor - limit - prev_cursor - next_cursor properties: cursor: type: - string - 'null' limit: type: integer example: 25 prev_cursor: type: - string - 'null' next_cursor: type: - string - 'null' CompanyDropletHealthClassification: type: object description: >- Where the installation sits relative to a checkout, from its active callbacks and its scopes. required: - criticality - domains - checkout_path - commerce_access - blocking - reasons properties: criticality: type: string enum: - checkout_blocking - commerce_blocking - auth_blocking - checkout_async - non_blocking domains: type: array items: type: string enum: - cart - subscription - order - payment - auth - email - platform checkout_path: type: boolean description: Whether it answers a callback fired during a checkout. commerce_access: type: boolean description: Whether its scopes can read or change cart, order or payment data. blocking: type: boolean description: Whether Fluid waits on its response to finish a request. reasons: type: array items: type: string CompanyDropletHealthMetrics: type: object required: - request_count - failure_count - timeout_count - failure_rate - average_ms - worst_p95_ms - max_ms properties: request_count: type: integer failure_count: type: integer description: Requests that did not return a successful answer. timeout_count: type: integer description: Requests that timed out, a subset of failures. failure_rate: type: number description: Failures over requests, 0 to 1. average_ms: type: - number - 'null' worst_p95_ms: type: - number - 'null' description: The highest p95 among the callbacks folded in. max_ms: type: - number - 'null' CompanyDropletHealthRegistration: type: object required: - uuid - definition_name - criticality - domain - url - active - country_codes - metrics properties: uuid: type: string definition_name: type: string description: The callback it answers, e.g. `update_cart_tax`. criticality: type: - string - 'null' enum: - checkout_blocking - commerce_blocking - auth_blocking - checkout_async - non_blocking - null description: '`checkout_blocking` means a checkout waits on this callback.' domain: type: - string - 'null' enum: - cart - subscription - order - payment - auth - email - platform - null url: type: - string - 'null' description: >- The endpoint Fluid calls, as scheme, host and path only. A query string, fragment or credentials in the registered URL are never returned. active: type: - boolean - 'null' country_codes: type: array items: type: string description: Countries the callback is limited to; empty means every country. metrics: description: >- Null when the figures could not be read; zero requests means nothing called it. oneOf: - type: 'null' - $ref: '#/components/schemas/CompanyDropletHealthMetrics' responses: Unauthorized: description: >- Missing or invalid bearer token. The body is a bare `{ message }`, not the error envelope. content: application/json: schema: $ref: '#/components/schemas/UnauthorizedError' example: message: Invalid credentials. Forbidden: description: >- Authenticated, but not a company admin with the needed droplets permission, or a droplet installation token. The body is bare. content: application/json: schema: $ref: '#/components/schemas/ForbiddenError' example: message: Not authorized. NotFound: description: >- No such droplet for your company. Another company's private droplet, and on writes another company's droplet of any status, read as missing. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Droplet not found details: {} status: 404 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-18T15:32:08Z' UnprocessableEntity: description: Invalid parameters, or a write the droplet refused. content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' example: error: message: Invalid parameters details: droplet: name: - is missing status: 422 meta: request_id: 7e2c9b41-3f8a-4d15-b6e0-9a4c21d7f583 timestamp: '2026-10-18T15:32:08Z' securitySchemes: bearer_auth: type: http scheme: bearer description: >- A company admin credential for your company. Droplet installation tokens are refused. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.