Custom store API  /  Privacy & checklist

Privacy and review checklist

Privacy

• Never return orders, shipments or member data that don't belong to the requested owner (respond 404).
• Send only the fields you need. Never send card or bank details, national ID numbers, passwords or internal admin notes.
• Mask names, phone numbers and emails in buyer, receivers and member data (e.g. ki***@example.com, 010-****-5821). Don't pass Cafe24 responses through as is.
• Don't log API keys. Rotate them in the console in two steps: issue, then activate. The previous key keeps working until you activate the new one.

Review checklist

v1.0

• Missing or wrong key → 401
• No owner (member_id/buyer_cellphone) on /v1/orders → 400
• Someone else's order → 404; the customer's own order → 200
• limit over 50 is capped at 50, and next_cursor pages through to the end
• IDs and amounts are strings, amounts come with currency, timestamps are ISO 8601
• Field names match Cafe24, and item order_status uses Cafe24 codes
• Item image is a non-empty absolute https URL (the product's main image if the option has no photo)
• Console [Test connection] passes (capabilities returns 200 or 404)

v1.1

• Every endpoint for a feature turned on in capabilities returns 200 (features left off may return 404)
• Writing twice with the same Idempotency-Key returns the same response the second time without running it; a different body returns 409 idempotency_conflict
• Canceling an in-transit (N30) order → 409 not_allowed_in_state; before shipping → 200 + C00
• A write with member_id on someone else's order → 404
• Error bodies are { "error": { "code", "message" } }
• The since_product_no list is in ascending order, includes hidden products, and the last page has fewer than limit

[Test connection] only checks /v1/capabilities. Compare your order and member responses against the examples on these pages yourself. Always test writes with test orders.