Commerce Claw
API · curl examples

The API in 5 calls.

No SDK. No client library. Just HTTP. Auth is a signed session cookie (HttpOnly, Secure, SameSite=Lax). Sensitive actions are gated by the approval queue regardless of how you call them.

01 · GET /api/public/connectors · none

Public catalog — list all 56 connectors

curl https://businessclaw.agentabrams.com/api/public/connectors | jq '.connectors[0]'
{
  "id": "shopify",
  "name": "Shopify",
  "category": "commerce",
  "logo": "shopify",
  "tint": "#95BF47",
  "triggers": 5,
  "actions": 8,
  "sensitive": true
}
02 · POST /api/demo-classify · rate-limited (8/min/IP)

Demo classifier — try the routing without signing in

curl -X POST https://businessclaw.agentabrams.com/api/demo-classify \
  -H 'content-type: application/json' \
  -d '{"message":"refund order 1234 on shopify"}'
{
  "ok": true,
  "intent": {
    "connector": "shopify",
    "action": "order.refund",
    "reason": null
  }
}
03 · POST /api/auth/login · none

Login — receive a session cookie

curl -i -X POST https://businessclaw.agentabrams.com/api/auth/login \
  -H 'content-type: application/json' \
  -d '{"email":"you@example.com","password":"…"}'
HTTP/2 200
set-cookie: cc_session=…; HttpOnly; Secure; SameSite=Lax
{ "ok": true, "user": { "id": …, "email": "…", "role": "user" } }
04 · POST /api/chat · session cookie

Chat — route a command (auth required)

curl -X POST https://businessclaw.agentabrams.com/api/chat \
  -b 'cc_session=…' \
  -H 'content-type: application/json' \
  -d '{"message":"post in #launch on slack saying we shipped"}'
{
  "reply": "Queued slack.chat.postMessage for admin approval.",
  "toolCalls": [{
    "connector": "slack",
    "action": "chat.postMessage",
    "queued": true,
    "input": { "channel": "launch", "text": "we shipped" }
  }]
}
05 · POST /api/me/connections/:id · session cookie

Save a connector token (per-user vault)

curl -X POST https://businessclaw.agentabrams.com/api/me/connections/stripe \
  -b 'cc_session=…' \
  -H 'content-type: application/json' \
  -d '{"api_key":"sk_live_…"}'
{ "ok": true, "saved": ["api_key"] }
# Token is AES-256-GCM encrypted at rest before write.

Need an endpoint that's not here? Email info@agentabrams.com.