Public online store API
Production server-to-server REST API for integrating Lueira's catalogue and shopping flows into your own site. Operations require access to be enabled for your tenant.
Endpoints
Base URL: https://api.lueira.com/api/store/v1. The OpenAPI specification lists all 113 operations, parameters, scopes, models and responses: rental, bundle, lesson, course, pass and shop catalogues; availability and pricing; forms and uploads; carts, discounts, checkout and payments; customer login and account; orders, vouchers and session bookings.
Access and scopes
An administrator will subscribe to the online store add-on separately and create an online_store key with only the required scopes. An admin key cannot access the store API; a store key cannot access the admin API or MCP.
- Catalogue and availability:
store:catalog:read,store:availability:read. - Cart and checkout:
store:cart:read,store:cart:write,store:checkout:write. - Orders:
store:orders:read. - Customers:
store:customer:read,store:customer:write. - Vouchers:
store:vouchers:read,store:vouchers:write.
Shopper authorization
The key identifies the tenant. Store-ID selects one of its enabled stores. Shopper routes also require Customer-Authorization: Bearer <token>. Cart operations use the cart's own Cart-Access-Token. Keep these secrets on a server.
Request and response headers
The interactive reference declares headers on each operation. Use these common and conditional headers:
| Direction | Header | When and why |
|---|---|---|
| Request | Authorization: Bearer <api_key> | Required on operations; use an online_store key. Never expose it in browser JavaScript. |
| Request | Store-ID | Optional. Selects an enabled store; omitted means the tenant's main store. |
| Request | X-Lueira-Center-Slug | Optional. Selects a visible center by slug for multi-center stores. |
| Request | Customer-Authorization: Bearer <token> | Required on operations that need a customer session. |
| Request | Cart-Access-Token and Cart-ID | Send on cart operations indicated by OpenAPI. Treat the cart token as a secret. |
| Request | Idempotency-Key | Required on mutations; use a unique key of up to 255 characters and keep it on retries. |
| Request | Content-Type: application/json | Send when the request includes a JSON body. |
| Response | X-Request-ID | Present on every response; include it when contacting support. On errors it matches error.request_id. |
| Response | X-Lueira-Api-Version | API version, for example store-v1. |
| Response | X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset | Per-minute limit, remaining requests, and reset time. |
| Response | Retry-After | Seconds to wait after a 429 response. |
| Response | X-Store-Usage, X-Store-Included, X-Store-Grace, X-Store-Overage-Packs, X-Store-Usage-Reset | Monthly usage and allowance on successful responses; reset is UTC. |
| Response | X-Next-Offset, X-Total-Count | Pagination metadata when returned by the operation. |
| Response | Cart-ID, Cart-Access-Token, Idempotency-Replayed | Cart headers when applicable. Idempotency-Replayed: true means a stored response was returned. |
allowed_origins configures CORS only; it does not authenticate users. Browsers can read response headers exposed by CORS when the origin is allowed.Allowed origins
You can configure allowed_origins on each store key. They only control which browser origins receive CORS responses; they do not replace authentication or act as an IP allowlist.
Safe retries
Every mutation requires a unique Idempotency-Key. Repeating an identical request with the same key returns its original response; reusing the key with different input returns 409. If an operation is awaiting reconciliation it also returns 409: keep the key and check its state before retrying a purchase.
Quotas and billing
The add-on uses a separate monthly Stripe subscription, even with an annual main plan. The first month is prorated to the next UTC month. After the included allowance, a free 5% grace applies; then each started block of 25,000 successful requests costs €25. Reaching the monthly allowance does not stop requests. The per-minute limit still applies and can return 429.
| Plan | Monthly add-on | Req/min | Included/month |
|---|---|---|---|
| Básico | €49 | 150 | 75,000 |
| Pro | €99 | 300 | 375,000 |
| Premium | €179 | 750 | 1,500,000 |
online_store key with minimum required scopes, and access enabled for your tenant.