Changelog

This page lists additive changes as they ship. Breaking changes use a new dated version and never change an existing version. See Versioning.

2026-08

The first version of the Store API.

Authentication

• Store API keys, sent as X-API-Key. Every path names the store, and the key must match it.

Endpoints

• GET /status confirms the API is up and the key works for the store.
• GET /catalog-products and GET /catalog-products/:catalogProductId read the blanks available to the store, with their decoration methods and print areas.
• GET /products and GET /products/:productId read products, with status filters and sorting by name, update date or creation date.
• POST /artworks, GET /artworks and GET /artworks/:artworkId upload artwork from an HTTPS URL and read it back.
• POST /orders creates an order from products or from custom items, with externalOrderId for safe retries.
• GET /orders and GET /orders/:orderId follow an order through production, payment and shipping.

Custom items

• A line item can be assembled at order time from a catalog product variant, an artwork and one or more decorations, without building a product first.

Webhooks

• products_create, products_update, products_delete, orders_create and orders_update.
• HMAC-SHA256 signatures in X-Pengine-Signature, keyed with the store API key.
• Five delivery attempts with exponential backoff, and a 14 day delivery log.

Limits

• A burst of ten requests per store, followed by two requests per second.
• Lists page at 50 by default and 100 at most.
• A 14 day request log, readable from the Pengine app.