> ## Documentation Index > Fetch the complete documentation index at: https://developers.tassyir.io/llms.txt > Use this file to discover all available pages before exploring further. # Get a product > Needs the `read_products` scope (permission `products:read`). ## OpenAPI ````yaml /openapi/openapi.2026-10.json get /apps/2026-10/products/{id} openapi: 3.1.0 info: title: Tassyir Admin API version: 2026-10 summary: >- The API installed apps call to read and change a Tassyir business, and the webhooks they receive. description: >- Version `2026-10` of the API installed Tassyir apps call. The routes live under `/apps/2026-10/`; the token endpoint and the key documents under `/apps/`. Guides, and a page for every error code: https://developers.tassyir.io. **Authentication.** `Authorization: Bearer tsy_at_…` from `POST /apps/oauth/token`. An app acts as a team member of the business: it reads and writes only what its granted scopes allow, only in the stores the merchant gave it, under the merchant's plan. **Conventions.** JSON fields are camelCase; ids are strings; times are ISO 8601 UTC; money is a decimal string (`"2500.00"`) with a `currency` field, never a number. A list answers `{ data, nextCursor }`, newest first, keyset-paged: `limit` 1 to 100 (default 50), `cursor` = the previous `nextCursor`. A single resource answers `{ data }`. `fields` trims a resource to the named top-level fields. Fields without `read_customer_contact` (buyer name, phones, address, notes) are omitted, not nulled. Every answer is `Cache-Control: no-store`. **Writes.** Send an `Idempotency-Key` to make a write safe to retry (24 hours per installation). **Errors.** `application/problem+json` with a stable `code`, a `fix` sentence, the `docs` page of the code and a `requestId`. Each operation lists every code it can answer; `x-tassyir-errors` lists every code a problem can carry, with its title, statuses and `fix`. HTTP 460 `STORE_SCOPE_FORBIDDEN` means a store outside the installation's stores. **Rate limits.** A leaky bucket per installation, by default 40 requests refilled at 4 a second: every answer carries `RateLimit-Limit`, `RateLimit-Remaining` and `RateLimit-Reset`; a refusal is 429 `RATE_LIMITED` with `Retry-After`. All the apps of one business also share a ceiling, by default 20 requests a second: 429 `BUSINESS_RATE_LIMITED` with `Retry-After`. An API process that is already running its maximum of app requests answers 503 `API_BUSY` with `Retry-After`, having done nothing. **Webhooks.** Signed Standard Webhooks deliveries (`v1a`, Ed25519), one per topic below; verify them with `GET /apps/webhook-keys`. servers: - url: https://api.tassyir.io security: - appAccessToken: [] tags: - name: Authentication description: Tokens and the public keys apps verify with. - name: Business description: The business the app is installed on. - name: Orders description: Orders, their comments and the cancel reasons. - name: Products description: Products and their variants. - name: Collections description: Collections and their members. - name: Inventory description: Stock levels. - name: Customers description: The buyers behind the orders. - name: Stores description: The installation's stores. - name: Delivery description: Delivery agents and fee groups (never credentials). - name: Data description: >- Typed values the app keeps on the business, its stores, products, orders and customers, under keys its manifest declares. - name: Images description: >- Images re-hosted on the Tassyir CDN, for the product and collection writes. - name: Bulk exports description: >- A whole list (orders, products, customers) as one JSON Lines file, instead of paging through it. - name: Webhooks description: What Tassyir POSTs to the app. paths: /apps/2026-10/products/{id}: get: tags: - Products summary: Get a product description: Needs the `read_products` scope (permission `products:read`). operationId: getProduct parameters: - name: id in: path required: true description: >- A resource id. One this installation cannot read, or a malformed one, is 404 `NOT_FOUND`. schema: type: string minLength: 1 - name: fields in: query required: false schema: maxLength: 1000 type: string description: >- Return only these top-level fields, separated by commas; the id is always kept. The response schema describes the whole resource. An unknown name is 400 `INVALID_FIELDS`. Fields: `id`, `storeId`, `name`, `slug`, `description`, `type`, `active`, `visible`, `currency`, `price`, `compareAtPrice`, `sku`, `barcode`, `image`, `images`, `weightKg`, `dimensionsCm`, `tracksInventory`, `allowOutOfStockOrders`, `collectionIds`, `brandId`, `options`, `variants`, `createdAt`, `updatedAt`. responses: '200': description: The product. headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Cache-Control: $ref: '#/components/headers/Cache-Control-No-Store' content: application/json: schema: $ref: '#/components/schemas/ProductResponse' '400': description: 'Bad request: `INVALID_FIELDS`, `VALIDATION_FAILED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 400 code: enum: - INVALID_FIELDS - VALIDATION_FAILED '401': $ref: '#/components/responses/Unauthorized' '403': description: 'Not allowed: `PERMISSION_DENIED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 403 code: enum: - PERMISSION_DENIED '404': description: 'Not found: `NOT_FOUND`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 404 code: enum: - NOT_FOUND '429': $ref: '#/components/responses/RateLimited' '500': $ref: '#/components/responses/InternalError' '503': $ref: '#/components/responses/Unavailable' components: headers: RateLimit-Limit: description: >- The installation's request bucket (default 40); on a 429 `BUSINESS_RATE_LIMITED`, the business's ceiling (default 20 a second). Absent when a request is refused before the rate limits run (an unparsable body, a 503 `API_BUSY`). schema: minimum: 1 type: integer RateLimit-Remaining: description: Requests still accepted right now. schema: type: integer minimum: 0 RateLimit-Reset: description: >- Seconds until the bucket is empty again (it drains at 4 requests a second by default). schema: type: integer minimum: 0 X-Request-Id: description: The request's id, also in an error's `requestId`. schema: type: string Cache-Control-No-Store: description: '`no-store`: never cache an answer.' schema: type: string const: no-store Retry-After: description: Seconds to wait before retrying. schema: type: integer minimum: 0 schemas: ProductResponse: type: object properties: data: $ref: '#/components/schemas/Product' required: - data additionalProperties: false Problem: type: object description: >- An Admin API error (RFC 9457 problem details), served as `application/problem+json`. Act on `code`, never on `detail`. Other members name the subject of the refusal (`permission`, `storeId`, `feature`, `limit`, `errors`, …). properties: type: type: string format: uri description: >- `https://developers.tassyir.io/errors/`: identifies the code, and is the code's page. title: type: string status: type: integer detail: type: string description: >- For a person. A 5xx never carries an internal message: `requestId` names it. code: type: string pattern: ^[A-Z][A-Z0-9_]{1,63}$ description: 'Stable: what the app acts on.' fix: type: string description: One sentence an AI agent can act on. docs: type: string format: uri description: >- The page that explains the code and what to do: the same URL as `type`. requestId: type: string description: Also in the `X-Request-Id` header. Quote it to Tassyir. errors: type: array items: type: string description: 'With `VALIDATION_FAILED`: one entry per invalid parameter.' required: - type - title - status - detail - code - docs Product: type: object properties: id: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). storeId: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). name: type: string slug: anyOf: - type: string - type: 'null' description: anyOf: - type: string - type: 'null' description: HTML. type: type: string description: PHYSICAL or PACK. active: type: boolean description: False once the merchant deactivates it. visible: type: boolean description: Shown on the storefront. currency: type: string pattern: ^[A-Z]{3}$ description: ISO 4217 currency code of every amount in this resource. price: type: string pattern: ^-?\d+\.\d{2}$ description: A decimal amount with two decimals, as a string ("2500.00"). compareAtPrice: anyOf: - type: string pattern: ^-?\d+\.\d{2}$ description: A decimal amount with two decimals, as a string ("2500.00"). - type: 'null' sku: anyOf: - type: string - type: 'null' barcode: anyOf: - type: string - type: 'null' image: anyOf: - type: string - type: 'null' images: type: array items: type: string description: Gallery, in display order. weightKg: anyOf: - type: number - type: 'null' dimensionsCm: anyOf: - type: object properties: width: type: number height: type: number length: type: number required: - width - height - length additionalProperties: false - type: 'null' tracksInventory: type: boolean allowOutOfStockOrders: type: boolean collectionIds: type: array items: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). brandId: anyOf: - type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). - type: 'null' options: type: array items: type: object properties: name: type: string values: type: array items: type: string required: - name - values additionalProperties: false variants: type: array items: $ref: '#/components/schemas/ProductVariant' createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: ISO 8601 date-time, UTC. updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: ISO 8601 date-time, UTC. required: - id - storeId - name - slug - description - type - active - visible - currency - price - compareAtPrice - sku - barcode - image - images - weightKg - dimensionsCm - tracksInventory - allowOutOfStockOrders - collectionIds - brandId - options - variants - createdAt - updatedAt additionalProperties: false description: A product (API 2026-10). ProductVariant: type: object properties: id: type: string minLength: 1 maxLength: 64 description: A resource id (a snowflake id, as a string). name: anyOf: - type: string - type: 'null' sku: anyOf: - type: string - type: 'null' barcode: anyOf: - type: string - type: 'null' price: type: string pattern: ^-?\d+\.\d{2}$ description: A decimal amount with two decimals, as a string ("2500.00"). compareAtPrice: anyOf: - type: string pattern: ^-?\d+\.\d{2}$ description: A decimal amount with two decimals, as a string ("2500.00"). - type: 'null' image: anyOf: - type: string - type: 'null' isDefault: type: boolean hidden: type: boolean description: Hidden from the storefront. options: type: array items: type: object properties: name: type: string value: type: string required: - name - value additionalProperties: false description: 'The option values this variant is, e.g. Size: M.' createdAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: ISO 8601 date-time, UTC. updatedAt: type: string format: date-time pattern: >- ^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$ description: ISO 8601 date-time, UTC. required: - id - name - sku - barcode - price - compareAtPrice - image - isDefault - hidden - options - createdAt - updatedAt additionalProperties: false responses: Unauthorized: description: 'No usable access token: `APP_TOKEN_INVALID`, `APP_TOKEN_REQUIRED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' WWW-Authenticate: description: The Bearer challenge (RFC 6750). schema: type: string content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 401 code: enum: - APP_TOKEN_INVALID - APP_TOKEN_REQUIRED RateLimited: description: 'Rate limited: `BUSINESS_RATE_LIMITED`, `RATE_LIMITED`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Retry-After: $ref: '#/components/headers/Retry-After' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 429 code: enum: - BUSINESS_RATE_LIMITED - RATE_LIMITED InternalError: description: 'Internal error: `INTERNAL_ERROR`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 500 code: enum: - INTERNAL_ERROR Unavailable: description: 'Unavailable: `API_BUSY`, `SERVICE_UNAVAILABLE`.' headers: RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' X-Request-Id: $ref: '#/components/headers/X-Request-Id' Retry-After: $ref: '#/components/headers/Retry-After' content: application/problem+json: schema: allOf: - $ref: '#/components/schemas/Problem' - properties: status: const: 503 code: enum: - API_BUSY - SERVICE_UNAVAILABLE securitySchemes: appAccessToken: type: http scheme: bearer bearerFormat: tsy_at_<43 base62> description: >- An app access token from `POST /apps/oauth/token`, valid 1 hour. An offline token acts as the app; an online token acts as the app on behalf of one dashboard user (the intersection of both permission sets). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.