X-API-KEY header, as described on the Authentication page.
Methods
The API follows REST conventions across the journey:Session identifier
Every call after session creation carries thesessionId in the path, for example /v1/{sessionId}/cart. Create a session first with POST /v1/Session, then reuse its identifier for the rest of the journey. The identifier is a UUID.
Headers
Idempotency
Read calls (GET) are safe to retry: they never change state. PUT and DELETE calls are idempotent while the session is Pending: repeating them leaves the cart in the same state. Once the session is paid, the cart no longer accepts changes. POST calls are not idempotent: retrying Add a cart item can duplicate the item, so retry it only when you know the previous call did not reach the server.