> ## Documentation Index > Fetch the complete documentation index at: https://dev.puppetvendors.com/llms.txt > Use this file to discover all available pages before exploring further. # List products > List every vendor's products in your store, or one vendor's with `?vendorId=`. Supports the same filters, sorting and cursor pagination as the vendor API. Requires the `admin:products:read` permission. ## OpenAPI ````yaml openapi-merchant.json GET /products openapi: 3.0.0 info: title: PuppetVendors Merchant API V2 version: 2.0.0 description: >- The endpoints reachable with a merchant API key (`mk_live_…`), minted from Settings → API Access in the PuppetVendors admin. A merchant key administers users and vendors, and renews its own token. Everything else in the V2 API, including orders, products, payouts, fulfillments and documents, stays on the v1 API token and is refused here with a 403. Keys are revealed once at creation; rotating one leaves the previous key working for a 24 hour grace window. contact: name: PuppetVendors Support url: https://puppetvendors.com license: name: Proprietary servers: - url: https://production-api.puppetvendors.com description: Production - url: http://localhost:8082 description: Local development security: - bearerAuth: [] tags: - name: Auth description: Authentication endpoints for obtaining and refreshing API tokens - name: Portal - Auth description: Vendor portal authentication endpoints (vendor user login, token refresh) - name: Products description: Product management and synchronization - name: Merchant Products description: >- Every vendor's products in your store, read and edited with a merchant API key, plus bulk approval and rejection of pending products. A missing product returns 404 `PRODUCT_NOT_FOUND`. - name: Orders description: Order retrieval and management - name: Payouts description: Vendor payout information - name: Fulfillments description: Order fulfillment operations - name: Reports description: Vendor sales reports and analytics - name: Vendors description: Vendor management operations - name: Settings description: Settings endpoints for vendor configuration and management - name: Users description: User account management - name: Shop description: Shop configuration and settings - name: Commissions description: Commission rate management - name: Integrations description: Vendor integration configuration endpoints - name: Line Items description: Order line item operations paths: /products: get: tags: - Merchant Products summary: List products description: >- List every vendor's products in your store, or one vendor's with `?vendorId=`. Supports the same filters, sorting and cursor pagination as the vendor API. Requires the `admin:products:read` permission. operationId: merchantListProducts parameters: - in: query name: vendorId schema: type: string description: >- Narrow to this vendor. Must be a vendor of this shop (403 otherwise, 400 when malformed). example: 507f1f77bcf86cd799439012 - in: query name: status schema: type: string description: >- One status, several comma-separated (`status=active,draft`) or the parameter repeated. Values: active, draft, pending, error, deleted, archived. Each matches stored statuses, and rows come back with the stored value: active matches live and active; archived matches archived and disapprove (a product archived on Shopify is stored as archived by PuppetVendors and the legacy sync alike; disapprove is rejected by the merchant, or an older archived row); draft, pending, error and deleted match the same stored value. example: active,draft - in: query name: inventoryStatus schema: type: string enum: - inStock - outOfStock description: inStock is a total inventory above 0; outOfStock is 0 or below. - in: query name: createdAtMin schema: type: string format: date-time description: Created at or after this ISO 8601 time. example: '2026-01-01T00:00:00Z' - in: query name: createdAtMax schema: type: string format: date-time description: Created at or before this ISO 8601 time. - in: query name: search schema: type: string maxLength: 200 description: >- Full-text search on the product title and vendor name (whole words, not substrings). - in: query name: first schema: type: integer minimum: 1 maximum: 100 description: Page size when paging forward (default 20). Use with `after`. - in: query name: after schema: type: string description: The `pageInfo.endCursor` of the previous page. - in: query name: last schema: type: integer minimum: 1 maximum: 100 description: Page size when paging backward. Use with `before`. - in: query name: before schema: type: string description: The `pageInfo.startCursor` of the page after the one wanted. - in: query name: sortBy schema: type: string enum: - title - totalInventory - createdAt - updatedAt default: updatedAt - in: query name: sortOrder schema: type: string enum: - asc - desc default: desc responses: '200': description: One page of products content: application/json: schema: $ref: '#/components/schemas/SuccessResponse' '400': description: Invalid query parameters content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '401': description: Missing, invalid or revoked token content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' '403': description: >- Not a merchant API key, the key lacks admin:products:read, or vendorId is not a vendor of this shop content: application/json: schema: $ref: '#/components/schemas/ErrorResponse' security: - bearerAuth: [] components: schemas: SuccessResponse: type: object required: - success - data properties: success: type: boolean enum: - true description: Indicates the request was successful data: description: The response payload ErrorResponse: type: object required: - success - error properties: success: type: boolean enum: - false description: Indicates the request failed error: type: object required: - message properties: message: type: string description: Human-readable error message example: Resource not found code: type: string description: >- Stable machine-readable error code. The frontend uses this as its localisation key (e.g. errors.api.). Server errors always report INTERNAL_SERVER_ERROR. example: NOT_FOUND errorId: type: string description: >- Correlation id for support/log lookup. Present on opaque 5xx responses so a user can quote a reference for the underlying (server-side logged) error. example: err_1783365360839_j281w7b details: type: object description: >- Additional client-error context (e.g. field-level validation errors). Never populated for server errors. securitySchemes: bearerAuth: type: apiKey in: header name: x-access-token description: >- JWT minted from a merchant API key (`mk_live_…`) by POST /authenticate. Send the token value directly, with no "Bearer" prefix. Tokens last 14 days and can be renewed at POST /refresh-token; revoking the key refuses the next request made with any token minted from it. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.