API Reference

Which API do you need? Every engine, its host, its auth, and your first call — the router for all twelve API surfaces.

The StateSet iCommerce Engine is one product with twelve API surfaces, and each runs on its own host with its own key. This page routes you to the right one in under a minute.

I want to…

Task	API	First call
Provision a new brand across every engine	Brand Onboarding	onboarding.stateset.com
Answer customers with an AI agent (chat, email)	ResponseCX	Create an agent
Put an agent on the phone	Voice	Create a voice agent
Embed chat on my site	Chat Widget	Implement POST /api/chat
Sync orders/inventory between Shopify, NetSuite, 3PLs	Sync Server	Sync Shopify ↔ NetSuite
Exchange EDI documents with a retailer	EDI	Your first 850 cycle
Create and manage orders, inventory, returns, finance	Commerce Engine	Orders
Run a durable, replayable workflow	Temporal Engine	First durable workflow
Gate an agent’s action with a verified decision	NSR	Gate a refund
Automate a tool that has no API	Computer Use	First computer-use task
Give an agent an isolated runtime for code	Sandbox	Sandboxes
Train and serve an improved model from conversations	Agents	StateSet Agents

Building an AI agent rather than an app? Start at Getting started for AI agents — every MCP server and skill in one place.

Hosts, keys, headers

One key does not fit all: each engine issues its own credentials and reads its own header. The generated examples on every page use the env var named here — export it once and every curl on that tab pastes clean. Host status shows what answers today, probed rather than promised.

API	Host	Auth header	Export	Where the key comes from
ResponseCX	response.stateset.com/api/v1	Authorization: Bearer	RESPONSECX_API_KEY	The app: Settings → API keys (rcx_…, shown once)
Voice	api.voice.stateset.com	Authorization: Bearer	STATESET_VOICE_API_KEY	Issued at onboarding; mint more with POST /api-keys (the secret is returned once — see the Voice skill)
Chat Widget	your backend	x-widget-token (optional)	—	You sign it yourself (STATESET_WIDGET_AUTH_SECRET)
Sync Server	api.sync.stateset.com	x-stateset-api-key	STATESET_SYNC_API_KEY	Issued with your tenant at onboarding
EDI	edi.stateset.com	Authorization: Bearer	STATESET_EDI_API_KEY	Per trading partner: POST /v1/partners/{id}/api-key
Commerce Engine	no public host yet — status	Authorization: Bearer	STATESET_API_KEY	With the host, when it ships
Temporal Engine	api.workstream.stateset.com	x-api-key	STATESET_TEMPORAL_API_KEY	Per brand: POST /v1/brands/{brand_id}/api-keys (sk_live_…, shown once)
NSR	api.nsr.stateset.com	X-API-Key	STATESET_NSR_API_KEY	Issued with your org — see the NSR console
Computer Use	api.computer.stateset.app (provisioning)	X-API-Key	STATESET_COMPUTER_USE_API_KEY	Mint with POST /keys using your first key
Sandbox	api.sandbox.stateset.app	Authorization: ApiKey	STATESET_SANDBOX_API_KEY	Issued with your workspace — talk to us
Agents	self-hosted (stateset-agents serve)	X-API-Key or Bearer JWT	STATESET_AGENTS_API_KEY	You set it: API_KEYS env on your deployment

Most hosted keys are provisioned when your brand is onboarded — one flow creates the org and credentials across the engines you activate.

Two surfaces are contracts you deploy rather than hosted services: the Chat Widget API is what your backend implements for the widget, and the Agents API is the gateway stateset-agents serve runs.

Conventions that hold everywhere

• JSON in, JSON out, except EDI outbound routes, which return the wire-ready X12 interchange (application/edi-x12), and streaming routes, which return text/event-stream.
• Idempotency: mutating routes accept an Idempotency-Key header where the page says so — a retry with the same key replays the stored outcome instead of acting twice.
• Errors: every engine returns a machine-readable error body — the shapes differ, and Errors across the engines lays them side by side with the five families an agent should branch on.
• Rate limits are per-endpoint and named on each page’s Access table where the spec declares them.
• Deprecations are announced, not sprung: a deprecated Temporal route answers with a Deprecation header carrying its sunset date, and every tab’s API history page lists operations added or removed from the surface, so a migration is a diff you can read.

Explore

Host status

What answers today — generated by probing, with a checked date.

Authentication

How keys are issued, scoped, and rotated.

For AI agents

MCP servers, skills, and the rules of engagement.