> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fluid.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract.
> Authenticate with the header Authorization: Bearer <token>; public storefront read endpoints require no auth.
> To sign a new merchant up for Fluid programmatically, run `fluid signup` from the Fluid CLI, or call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. Before authenticated calls are possible, the merchant must sign the agent in to the Fluid CLI with the emailed code and --shop set to the company's fluid_shop (which also confirms the signup), or open the emailed confirmation link and give the agent an API token.
> After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch.
> Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null.
> When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only on an operation whose spec documents those params — mostly the unversioned company-v0 admin surface, plus some lists on other surfaces, versioned ones included; page every other list with cursors.
> Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile.
> The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated except two operations that take no credential, POST /api/company (create a company) and GET /api/agreements/{id} — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country).
> api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract).
> Successful responses wrap the resource payload alongside a top-level integer status and a meta object.
> Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other.
> For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces.
> Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings.
> Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties.
> Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables.
> A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation.
> The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations.
> Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check.
> Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times.

# Answer callbacks from Fluid

> Register an endpoint that Fluid calls while a cart, checkout or login is in progress, verify each call, answer within the time limit, and keep checkout working when your endpoint fails.

A callback lets your server take part in something Fluid is doing. When a cart needs its tax calculated, for example, Fluid calls your endpoint and uses your answer. Webhooks only tell you something happened. A callback waits for your reply.

Most callbacks run while the shopper waits. A slow endpoint slows checkout down, so answer fast.

## Find the callback you need

Fluid publishes a catalog of callback definitions. Each definition names a moment, such as `update_cart_tax` or `cart_item_added`, and gives the request Fluid sends and the response it expects.

List the catalog with `GET /api/callback/definitions`. Each definition has a `name`, a `description`, a `request_schema`, a `response_schema` and an `example_response`. To fetch one definition's schemas, call `GET /api/callback/schemas/{definition_name}`.

```bash theme={null}
curl "https://api.fluid.app/api/callback/definitions" \
  -H "Authorization: Bearer <your_token>"
```

## Register your endpoint

Create a registration with `POST /api/callback/registrations`. Send the `definition_name` and the `url` Fluid calls. You can also set `active` and `country_codes`, the countries the callback applies to. Leave `country_codes` empty to apply it everywhere.

```bash theme={null}
curl -X POST "https://api.fluid.app/api/callback/registrations" \
  -H "Authorization: Bearer <your_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "callback_registration": {
      "definition_name": "update_cart_tax",
      "url": "https://tax.dundermifflin.com/fluid/callbacks/cart-tax",
      "active": true,
      "country_codes": ["US"]
    }
  }'
```

A registration is addressed by its `uuid`. Each owner, such as your company or an installed droplet, can have one registration for each definition. A second one for the same definition returns `409`, so edit the one you have instead. In production, the `url` must use HTTPS.

The response includes a `verification_token`. Store it on your server. You use it to check that a call came from Fluid.

You can also manage callbacks in the admin. See [Callbacks](https://docs.fluid.app/help/admin/settings/callbacks.md) in the Help Center.

## Verify each call

Fluid signs every call with the registration's `verification_token`. Each call carries these headers:

* `X-Fluid-Timestamp`: the Unix time in seconds when Fluid signed the call.
* `X-Fluid-Signature`: a hex HMAC-SHA256 of `<X-Fluid-Timestamp>.<raw_request_body>`, keyed with your `verification_token`.

Recompute the signature over the raw body exactly as you received it, then compare the two in constant time. It's the same check as for a webhook. See [Verify a delivery](https://docs.fluid.app/api/guides/webhooks.md#verify-a-delivery).

The call also carries the token itself in `X-Fluid-Callback-Token`. Verify the signature, not that header, and keep both out of your logs.

## Answer in time

Fluid sets the time limit for each definition. It's never more than 20 seconds, and many checkout callbacks, such as `cart_item_added`, allow only 5 seconds. A registration has no time limit of its own. The **Timeout** field in the admin doesn't change it.

Answer with a `2xx` status and a JSON object that matches the definition's `response_schema`. For `update_cart_tax`, that's the cart's new `tax_total`, with the tax for each line:

```json theme={null}
{
  "tax_total": 10.0,
  "lines": [
    { "item_id": "1", "tax": 6.0 },
    { "item_id": "2", "tax": 4.0 }
  ]
}
```

The request body carries the definition's fields, such as `cart` and `change_type` for `update_cart_tax`. It also carries `callback_name`, `schema_version` and `schema_hash`, so you can tell which callback and schema version a call is for.

## Plan for failure

Fluid counts a call as failed when it times out, returns anything other than `2xx` (redirects too), returns a body that isn't JSON, or returns JSON that doesn't match the `response_schema`. Fluid doesn't retry a failed call.

What happens next depends on the callback. A failed tax callback keeps the cart's current tax total. Some callbacks, such as `validate_cart_discount` and `update_cart_address`, fail open: the cart change goes ahead as if you had approved it. Each definition's `description` says how it behaves.

Build your endpoint so a problem on your side never stops a sale:

* **Answer from what you already have.** Don't call slow services while Fluid waits. Precompute or cache what you can.
* **Set your own deadline below Fluid's.** If an upstream service is slow, return a safe answer in time rather than no answer.
* **Don't fail closed by accident.** A `500` or a timeout isn't a "no". When you mean to refuse, refuse the way the definition's `response_schema` describes.

## Check a droplet's callback health

Each definition has a criticality. The highest is `checkout_blocking`: Fluid calls it inside a cart or checkout request, so your endpoint's response time adds to checkout's. Most cart callbacks, including tax, shipping and cart item changes, are `checkout_blocking`.

If a droplet registers your callbacks, [Check a droplet's health](https://docs.fluid.app/api-reference/droplets/check-a-droplets-health.md) shows how they behaved over a recent window: the droplet's `criticality`, each registration's request, failure and timeout counts, and response times, and an overall `verdict`. Read `metrics_available` first. When it's `false`, the metrics aren't available for that window.

## Next steps

* Browse [List callback definitions](https://docs.fluid.app/api-reference/callback-definitions/list-callback-definitions.md) and [Create a callback registration](https://docs.fluid.app/api-reference/callback-registrations/create-a-callback-registration.md) for the full request and response schemas.
* To receive events after they happen instead, see [Register and handle webhooks](https://docs.fluid.app/api/guides/webhooks.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.