> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fluid.app/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> For new direct REST integrations, use the v2026-04 surfaces. The @fluid-app FairShare SDK continues to use its own published public-v2025-06 contract.
> Authenticate with the header Authorization: Bearer <token>; public storefront read endpoints require no auth.
> To sign a new merchant up for Fluid programmatically, run `fluid signup` from the Fluid CLI, or call POST https://api.fluid.app/api/company with no credentials, as described in /api/agent-signup. Do not automate the signup form or book a demo. Before authenticated calls are possible, the merchant must sign the agent in to the Fluid CLI with the emailed code and --shop set to the company's fluid_shop (which also confirms the signup), or open the emailed confirmation link and give the agent an API token.
> After signup, to launch a merchant's store (back-office sync, payments onboarding, store setup, a theme copied from their current site, and a preview link before billing), follow /api/agent-launch.
> To host a small project on Fluid (a landing page, event page, calculator or dashboard), follow /sites/quickstart: npm create @fluid-app/fluid-site my-site (or npx @fluid-app/create-fluid-site my-site), fluid login, then fluid deploy prints the public URL. Launch a Site unless the project needs a custom domain, server rendering or heavy server code, which make it an App (a Mist app); /sites/site-or-app has the rule, and POST /api/company/v2026-10/project-launch-recommendations applies it. With only the Fluid MCP server (its Site write tools are limited to Fluid root admins today; see /sites/deploy-from-claude), use site_create, then site_deploy (send the built folder's manifest, PUT the listed uploads, call again with the bundle_id to get the url), then, only after the person confirms they want it public, site_visibility_set; the MCP server has no tools for logs, traffic, env vars or converting to an App, so use the fluid sites CLI for those.
> Lists use cursor pagination via the page[cursor] and page[limit] query params; follow meta.pagination.next_cursor until it is null.
> When the same operation exists on more than one surface, use the newest: dated API versions are newer than unversioned ones, and later dates win (v2026-04 > v2025-06 > unversioned v0/v1.1). Fall back to a legacy or unversioned operation only when no newer versioned equivalent exists — the company-v0 notes below list the known superseded operations. The same applies to /api/company/v1 and /api/v1/... paths: prefer a newer documented equivalent, and use one only when none exists (/api/v1.1/... is distinct and documented in company-v0). Use page/per_page offset pagination only on an operation whose spec documents those params — mostly the unversioned company-v0 admin surface, plus some lists on other surfaces, versioned ones included; page every other list with cursors.
> Fluid has three navigation APIs; don't mix them up. Storefront website menus (navigation bars, footers) are /api/menus and nested menu_items, in api-reference/content-v0.yaml (API Reference: Website > Navigation menus), with a how-to in themes/navigation-menus; their list uses flat page/per_page pagination. The Fluid mobile app's navigation is /api/v2/mobile_navigations, in api-reference/mobile-v2.yaml (API Reference: Mobile app > Navigation); its list also uses page/per_page. Portal navigations belong to a portal definition (Fluid OS), in api-reference/fluid-os-v0.yaml (API Reference: Portal > Portal navigation), and each has a platform of web or mobile.
> The OpenAPI specs under api-reference/ are the authoritative contracts; prefer them over prose when in doubt. api-reference/storefront-v2026-04.yaml covers the v2026-04 storefront surface (/api/v202604/... paths); api-reference/checkout-v2026-04.yaml covers the v2026-04 checkout surface (/api/checkout/v2026-04/... paths — carts, cart auth, discounts, items, subscriptions, orders, enrollments, and store config); api-reference/public-v2025-06.yaml covers the Public SDK surface used by the @fluid-app FairShare SDK, including its parallel cart lifecycle, browser integrations, versioned payment callbacks, unversioned public utilities, and the cart price-override operation; api-reference/payment-v2026-04.yaml covers the v2026-04 payment gateway admin surface (/api/payment/v2026-04/... paths, bearer-authenticated — gateway CRUD, gateway purchase/authorize/$0-verify, transaction list/show and capture/void/credit, and merchant payment configuration); api-reference/payments-v2026-04.yaml covers the v2026-04 cart payment surface (/api/payments/v2026-04/carts/{cart_token}/... paths, authenticated by the cart token in the path with no bearer — payment-method selection, VGS card tokenization, 3D Secure verification, and PayPal/Braintree/Klarna/Apple Pay flows); api-reference/commerce-v2026-04.yaml covers the v2026-04 commerce order-editing surface (/api/v202604/orders/{order_id}/edits paths, bearer-authenticated — post-checkout order edits that atomically insert items and add adjustments/discounts, with an optional dry-run preview); api-reference/webhooks-v0.yaml covers the unversioned webhooks surface (/api/... paths — webhook registration, delivery payloads, callback registrations, company events, and webhook/callback schemas); api-reference/company-v0.yaml covers the legacy unversioned company admin surface (/api/... paths, bearer-authenticated except two operations that take no credential, POST /api/company (create a company) and GET /api/agreements/{id} — company settings and management, customers, users, roles, subscription plans, subscription bundles, subscriptions, media, pages, catch-ups, inventory levels, domains, agreements, and admin order actions). company-v0 caveats: it is the legacy v0 admin contract and its lists use flat page/per_page offset pagination, which is expected there despite the general cursor-pagination rule; where an operation exists in both company-v0 and a versioned spec, prefer the versioned spec — the subscriptions lifecycle (list/create/show/update, cancel, pause, reactivate, resume, retry, skip, failed-cycle-waiver, discounts) and subscription bundles are superseded by checkout-v2026-04, and company pages/media CRUD plus the public pages, categories, products, and media list endpoints are superseded by storefront-v2026-04. Subscription plan management (/api/subscription_plans, resource-wrapped {"subscription_plan": {...}} bodies) exists only in company-v0. api-reference/members-v2025-06.yaml covers the v2025-06 unified Member identity surface (/api/v2025-06/members/... paths, bearer-authenticated — member list/create/show/update, lookup by email/username/external_id/legacy_customer_id, member-type assignment, and the sponsor genealogy read). Prefer it over the customers and reps surfaces when the member type matters: /customers does not serialize member_type. api-reference/analytics-v2026-04.yaml covers the v2026-04 Home dashboard analytics surface (/api/v202604/analytics/dashboard/... paths, bearer-authenticated — read-only endpoints for the Home > Overview, Home > Live, and Home > Field tabs, each accepting an optional country ISO alpha-2 query param that scopes aggregations to a single country).
> api-reference/analytics-v0.yaml covers the unversioned analytics surface that backs the fluid-admin Traffic tab (/api/analytics/... and /api/analytics/traffic/... paths, bearer-authenticated — the legacy shares/views/visitors summary plus traffic overview, ranked campaigns, sources, geographies, flows, and per-rep breakdown, all sharing one reporting-period contract).
> Successful responses wrap the resource payload alongside a top-level integer status and a meta object.
> Portal Definition authoring edits and synchronizes the portal JSON resource graph. Widget Package authoring builds either a company-owned or Droplet-owned Remote DOM package. These are separate contracts; do not imply that one defines the other.
> For Widget Package worker code, use only @fluid-app/portal-sdk/widgets/worker. Use only the Portal Definition and Widget Package workflows and public entry points documented here; do not infer support for undocumented surfaces.
> Every portal function and declarative capability used by a widget must appear in that widget's uses array. Use the same typed function value in uses; do not invent capability-name strings.
> Widget styling must use the portal's semantic theme variables for colors, typography, spacing, radii, borders, focus, and charts whenever a token represents the visual decision. Do not create a separate light or dark palette or duplicate theme controls as widget properties.
> Prefer worker-safe Fluid UI components exported by @fluid-app/portal-sdk/widgets/worker when they fit the interaction. When no exported component fits, use semantic HTML, accessible behavior, and the portal theme variables.
> A Portal Definition push updates the remote working definition. A portal version is an immutable snapshot, and activation is a separate live release operation.
> The Help Center (/help/...) is for merchants, admins and reps using Fluid. Its admin pages mirror the admin's routes: the screen at admin.fluid.app/settings/taxes is documented at /help/admin/settings/taxes. Use the Help Center for how-to questions about the admin, and the Developer Platform and API Reference for building integrations.
> Help Center pages describe what a company admin sees. A reader's role can hide screens and actions; admins manage roles on Settings > Roles (/help/admin/settings/roles). If someone can't find a screen or button, their role's permissions are the first thing to check.
> Send people who need Fluid support to /help/getting-help. Don't invent support email addresses, phone numbers or response times.

# Call the Member API from a Site

> Call the Fluid Member API from a Site as the signed-in visitor with fluid.api: how calls are signed in, which scopes a visitor gets, the response envelope, cursor pages, error codes and the routes a Site can't call.

A Site calls the Fluid [Member API](https://docs.fluid.app/api/member-apis.md) with `fluid.api` from `@fluid-app/sites`. Each call acts as the visitor who has the Site open, on their own data. Your code never holds a token.

## How a call is signed in

The visitor signs in to your storefront, not to your Site. When your code calls `fluid.api`, the SDK sends the call to the Site's own host, under `/_fluid/api/v2026-10/`. The host checks the visitor's storefront session and passes the call to `/api/member/v2026-10/` as that visitor.

* A visitor who isn't signed in gets `401` `sign_in_required`. Call `fluid.auth.signIn()` from a click to open the storefront's sign-in. See [The Sites SDK](https://docs.fluid.app/sites/sdk.md).
* Every call reads and writes the visitor's own data: their orders, their tasks, their profile. A Site can't read another person's data through `fluid.api`.

## What a visitor's calls may use

A call is served only when its scope is in the visitor's grant on the Site. The grant is the overlap of:

* the scopes the Site declares in `config/access.json`;
* the scopes your company allows on Sites. By default that's `search: read` only. An admin turns on others with **Visitor data** on the **Sites** list in the Fluid admin.

A call whose scope isn't granted answers `403` `scope_not_granted`, with the scope it needed in `error.details.scope`. Reads need a family's `read` scope, such as `orders: read`, and writes its `write` scope. See [Fluid data the site uses](https://docs.fluid.app/sites/declarations.md#fluid-data-the-site-uses) for the scope families and how a Site declares them.

### Routes a Site can't call

Some Member API routes answer `403` `forbidden` from a Site page whatever the Site declares:

* payment methods and card verifications;
* the visitor's companies and Exigo data;
* realtime messaging;
* a contact's activities, orders and subscriptions;
* the Sites routes themselves: Sites, shares, branches, deployments, databases, env vars, logs, traffic and the rest;
* notifications and features.

These are read-only from a Site page: addresses, notification devices, droplet queries, subscriptions and subscription bundles. A write answers `403` `forbidden`.

## The response

Every answer is JSON with `status`, `data` and `meta`. `fluid.api.get` returns the whole body, so read the records from `data`:

```json theme={null}
{
  "status": 200,
  "data": [{ "id": "…" }],
  "meta": {
    "request_uuid": "…",
    "timestamp": "2026-11-10T18:04:11Z",
    "pagination": { "next_cursor": "eyJ…" }
  }
}
```

### Pages

Lists use cursor pages, never page numbers or offsets:

* `page[limit]` sets the page size, at most 100. Search allows at most 50.
* `meta.pagination.next_cursor` is the cursor for the next page, or `null` on the last page.
* Pass it back as `page[cursor]` to read the next page, with the same filters.

A cursor that's malformed or too old answers `400` `invalid_pagination`. Start again from the first page.

### Errors

An error answers with `status`, `error` and `meta`. The code is in `error.details.error`:

```json theme={null}
{
  "status": 403,
  "error": {
    "message": "This site has not been granted this scope",
    "details": { "error": "scope_not_granted", "scope": "orders: read" }
  },
  "meta": { "request_uuid": "…", "timestamp": "…" }
}
```

`fluid.api.get` throws a `FluidRequestError` for any status that isn't 2xx. From `@fluid-app/sites` 0.1.57, its `code` reads `error.details.error` too, so `code` is `scope_not_granted` here. Earlier versions read only a top-level `error` string, so `code` is `null` for a Member API error. To work with both:

```ts theme={null}
const code = error.code ?? error.body?.error?.details?.error;
```

An invalid parameter answers `422`, with `error.details` naming each field and what's wrong with it.

## Examples

### Search the catalogue

Your company allows `search: read` by default, so this works once the Site declares it in `config/access.json` (`{ "uses": ["search: read"] }`) and the visitor is signed in. The template declares no scopes:

```ts theme={null}
import { fluid } from "@fluid-app/sites";

const { data } = await fluid.api.get("/search", {
  q: "protein",
  types: "products,pages",
  "page[limit]": "10",
});
```

`q` is 2 to 200 characters. `types` is a comma-separated list of `products`, `enrollment-packs`, `pages`, `media`, `playlists` and `posts`. Without `q`, `types` is required and the call browses those kinds.

### List the visitor's orders, a page at a time

Needs `orders: read` declared by the Site and allowed by your company:

```ts theme={null}
import { fluid } from "@fluid-app/sites";

async function allOrders() {
  const orders: unknown[] = [];
  let cursor: string | null = null;
  do {
    const query: Record<string, string> = { "filter[relationship]": "placed", "page[limit]": "25" };
    if (cursor) query["page[cursor]"] = cursor;
    const page = await fluid.api.get<{ data: unknown[]; meta: { pagination: { next_cursor: string | null } } }>("/orders", query);
    orders.push(...page.data);
    cursor = page.meta.pagination.next_cursor;
  } while (cursor);
  return orders;
}
```

`filter[relationship]` is `placed`, for orders the visitor bought, or `credited`, for orders credited to them.

### Add a task

Needs `tasks: write`. Tasks belong to reps, so a customer's call answers `403`:

```ts theme={null}
import { fluid, FluidRequestError } from "@fluid-app/sites";

const response = await fluid.api.fetch("/tasks", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    title: "Call Jane about the launch",
    due_at: "2026-11-14T17:00:00Z",
  }),
});
if (!response.ok) throw await FluidRequestError.fromResponse(response);
const { data: task } = await response.json();
```

`title` is required. `notes`, `due_at`, `priority` (`low`, `normal` or `high`) and `contact_id` are optional.

## Try it before you publish

`fluid sites dev` answers `fluid.api` with `503` `unavailable`, because there's no visitor on your machine. Mist's previews run as the member you're signed in to Mist as, so calls answer for you there. See [Develop locally](https://docs.fluid.app/sites/local-development.md#in-mist).

For every route, its parameters and its scope, see the [Member API reference](https://docs.fluid.app/api/member-apis.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.