---
title: "REST API and Commerce Integration Reference — citelayer®"
url: "https://citelayer.ai/docs/rest-api/"
date: 2026-02-25
---

# REST API and Commerce Integration Reference

Discover the routes registered on your site, then use the contract for the active component. Read-only checks and order-creating requests have very different effects.

Free operational routes
-----------------------

Method and routeAccess / effectGET `/wp-json/citelayer/v1/scan`Administrator scan; can perform checks and store resultsPOST `/wp-json/citelayer/v1/scan/reset`Administrator resetPOST `/wp-json/citelayer/v1/ai-referral`Validated browser arrival signal, not a public analytics read endpointWooCommerce integration contract
--------------------------------

Begin with GET `/ucp/capabilities`, `/ucp/openapi.json`, `/ucp/auth` and `/ucp/coverage` under `/wp-json/citelayer/v1`. They declare paths, schemas, auth and current coverage. Catalog and stateless cart checks are public and rate limited; signed draft-cart, lifecycle and order-read requests have separate scopes.

- Catalog: products, categories, product detail and search.
- Draft carts: signed create/read/item mutations/delete/calculate/checkout, key ownership and expiry.
- Checkout: pending-order handoff with buyer-reviewed WooCommerce payment URL.
- Lifecycle: signed status/cancel with lifecycle token.
- Order reads: signed reads for UCP-created orders with order token.

Signed Woo requests
-------------------

Use the auth contract’s HMAC-SHA256 canonical request format, timestamp and nonce. Assign only required scopes: `dev.ucp.shopping.cart:manage`, `dev.ucp.shopping.checkout:manage` or `dev.ucp.shopping.order:read`. Store signing secrets privately. Lifecycle/order calls also require the relevant checkout-issued token. Do not replace this with a WordPress nonce or send the secret in a URL.

EDD routes
----------

- GET `/ucp/downloads`, `/ucp/downloads/{id}`, `/ucp/downloads/categories`, `/ucp/search`.
- POST `/ucp/cart/validate` and `/ucp/cart/calculate`.
- GET `/ucp/checkout/gateways`; POST `/ucp/checkout` creates a pending EDD order.

EDD 1.2.1 does not include Woo’s signed cart resource or order lifecycle API. Use valid price-option IDs for variable-priced downloads.

Read one catalog item
---------------------

```
curl -i https://your-shop.example/wp-json/citelayer/v1/ucp/products?limit=1
curl -i https://your-shop.example/wp-json/citelayer/v1/ucp/downloads?limit=1
```

Use the first GET on a WooCommerce store and the second on EDD. Compare the returned price, stock semantics and valid price-option IDs with the store before preparing a cart. These catalog reads do not create an order.

Safe integration sequence
-------------------------

1. Inspect the site’s REST index and the active component/version.
2. Exercise GET catalog routes on test products first.
3. Validate and calculate a test cart before checkout.
4. Only issue checkout on a deliberate test store: it creates orders and processes billing input.
5. Verify error, rate-limit and expired-token behavior before connecting a production client.

Next step
---------

Continue with [the quick start checklist](/docs/quick-start/), or [check the common questions](/docs/faq/). For a reproducible problem, send the plugin versions, affected URL, expected result and actual response through [Support](/support/). Do not include passwords, license keys or customer details.

Reviewed 6 October 2026 against citelayer® Free 1.13.5, WooCommerce add-on 1.2.19 and EDD add-on 1.2.1. Features depend on the active components and settings on your site.