GraphQL API

yStore registers its own GraphQL operations on top of Craft CMS's native GraphQL layer. All operations are available at the /api endpoint using POST.

POST /api
Content-Type: application/json

{ "query": "{ products { title } }" }

Endpoint

The default GraphQL endpoint is /api. If you've changed Craft's GraphQL endpoint in config/general.php, use your custom path instead.

Queries

Read operations — products, cart, checkout, customer data, wishlists, and orders.

Mutations

Write operations — cart management, checkout flow, customer actions, order cancellation.

Authentication

Operation type	Auth required
Product queries	No (public)
Cart operations (with cartId)	No (guest-safe)
Customer account operations	Yes (logged-in customer session)
Order cancellation by guest	Email + order number verification

Token-based auth

If you are building a headless app, make sure your Craft GraphQL token has the correct schema permissions. yStore respects Craft's native GraphQL schema access controls.

Input types reference

All GraphQL mutations accept typed input objects. The most common ones:

Input type	Used in
CartItemInput	addProductsToCart
AddressInput	setShippingAddressOnCheckout, setBillingAddressOnCheckout
ShippingMethodInput	setShippingMethodOnCheckout
PaymentMethodInput	setPaymentMethodOnCheckout

Checkout flow (mutations sequence)

createGuestCart / createCustomerCart
  → addProductsToCart
  → setShippingAddressOnCheckout
  → setShippingMethodOnCheckout
  → setBillingAddressOnCheckout  (or same_as_shipping: true)
  → setPaymentMethodOnCheckout
  → placeOrder

Schema introspection

If any doc page and your runtime schema differ, always trust your running instance. Use GraphQL introspection to inspect the exact available fields for your build:

{ __schema { types { name fields { name } } } }