Public catalog feed (JSON)
Returns a store’s catalog as a public JSON feed — no API key required. This is the outbound counterpart to ingestion: a store opts in (admin → Catalog Sync → “Publish my catalog”) and its products become readable at a stable URL, so any system can pull them (another store’s scheduled sync, a partner, a script). Only storefront-safe fields are exposed — never cost or margins.
{store} is the store’s id or its short store code. If the store set a private token,
append ?token=…. The feed shape matches what the ingestion endpoints accept, so a
store-to-store sync is a direct pull-and-ingest with no field mapping.
Authorizations
API Key Authentication
Use your API key in the Authorization header:
Key Types:
Secret Keys (Server-Side Only):
- Format:
tybrite_sk_live_*(production) ortybrite_sk_test_*(sandbox) - Full read/write access to all endpoints
- ⚠️ NEVER expose in client-side code or public repositories
- Required for: write operations, authentication, payment verification, AI recommendations
Publishable Keys (Client-Safe):
- Format:
tybrite_pk_live_*(production) ortybrite_pk_test_*(sandbox) - Read-only access (GET requests only, plus POST semantic search)
- ✅ Safe for client-side JavaScript, mobile apps, and public code
- Allowed for: browsing products, search, CMS content, pricing queries
Endpoint-Specific Requirements:
- Authentication endpoints (
/v1/auth/*): Secret key required - Payment verification (
POST /v1/payments/verify): Secret key required - AI Recommendations (
POST /v1/recommendations): Secret key required - Semantic Search (
POST /v1/search): Both key types allowed (read-only operation) - All write operations: Secret key required
- All read operations: Both key types allowed
Using a publishable key for restricted operations returns 403 Forbidden.
Path Parameters
The store's id or short store code.
Query Parameters
Required only if the store protected its feed with a token.
Response
The store's catalog.

