The "store" is the top-level container of products, orders, customers, etc. Every key is bound to exactly one store. There is no way to query other merchants' stores.

GET /v1/store

Returns the profile of the store the calling key belongs to.

Auth: any active platform key bound to the store. Note: at v1 the store:read scope is not enforced on this endpoint — read endpoints are gated only by a valid key plus store scoping. The scopes actually enforced anywhere in v1 are products:write, orders:write, landing_pages:write, webhooks:read, webhooks:write and usage:read.

Cached for 30 s (per API key + query string) — a dashboard change can take up to 30 s to appear via api.dzbuild.app. Check the X-Cache: HIT|MISS response header. The alias dzbuild.com/api/v1/store is not cached.

Request

curl https://api.dzbuild.app/v1/store \
  -H "Authorization: Bearer $DZ_KEY"

Response 200

{
  "data": {
    "id":         13,
    "name":       "DZBuild",
    "slug":       "dzbuild",
    "language":   "ar",
    "description": "DZBuild Offers Preview",
    "logo":       "/uploads/logos/13/8e19a05f0e4205bbcd861469ec0f9257.webp",
    "favicon":    null,
    "banner":     null,
    "theme": {
      "primary_color":    "#f59e0b",
      "secondary_color":  "#fbbf24",
      "background_color": "#ffffff",
      "font_family":      "Cairo"
    },
    "subdomain":            "dzbuild.minacef.app",
    "custom_domain":        null,
    "custom_domain_verified": false,
    "public_url":            "https://dzbuild.minacef.app",
    "hide_branding":         false,
    "created_at":            "2026-01-13 14:58:23"
  },
  "meta": { "request_id": "...", "api_version": "v1" }
}

Field reference

Field	Type	Notes
`id`	int	Stable internal id. Same as `store_id` everywhere else.
`name`	string	Display name. Shown in storefront navbar + emails.
`slug`	string	URL-safe identifier. Used in `<slug>.dzbuild.app` etc.
`language`	enum	`ar` or `fr`. Drives storefront RTL/LTR.
`description`	string\|null	Short tagline.
`logo`	string\|null	Path on `cdn.dzbuild.app` if set. Prepend the CDN base if you display it.
`favicon`	string\|null	Same.
`banner`	string\|null	Same.
`theme.primary_color`	hex string	The dominant button + accent color.
`theme.secondary_color`	hex string	Hover / secondary accents.
`theme.background_color`	hex string	Page background.
`theme.font_family`	string	Typography (default `Cairo`).
`subdomain`	string\|null	The DZBuild-issued subdomain. Normally present; `null` if the store has no subdomain configured yet.
`custom_domain`	string\|null	The merchant's own domain. Only set if added via dashboard.
`custom_domain_verified`	bool	True only when DNS + SSL provisioning completed.
`public_url`	string\|null	Where customers actually land. Prefers a verified `custom_domain`; falls back to the subdomain; `null` if neither exists.
`hide_branding`	bool	"Powered by DZBuild" hidden in storefront footer. Unlimited.
`created_at`	timestamp	Store creation time, in Algiers time (UTC+01:00).

Errors

HTTP	Code	Cause
401	`unauthorized`	Bad or missing key
402	`quota_exceeded`	Store's monthly request quota exhausted — see Rate limits
403	`forbidden`	Pilot mode: key not enrolled ("API is in pilot mode; key not enrolled")
404	`not_found`	The store was deleted while you were holding the key (very rare)
429	`rate_limited`	Per-minute cap for this key; honour `Retry-After` — see Rate limits

PATCH /v1/store (coming v1.1)

Update store profile fields (name, slug, theme colors, custom domain).

This endpoint is reserved — the surface is locked but the implementation is part of the v1.1 milestone. Until then, edits go through the dashboard.

Keys already carry a store:write scope, but no write endpoint consumes it yet. PATCH /v1/store returns 405 method_not_allowed today, not 404 — and through api.dzbuild.app you get 400 bad_request first if you omit Idempotency-Key.

Store