POST
Add a retail location to the store directory

Authorizations

Authorization
string
header
required

A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.

Headers

Idempotency-Key
string
required

A unique key per logical write. Replaying a request with the same key returns the first response byte for byte instead of applying the write twice.

Body

application/json

The directory row only. The four geo fields (latitude, longitude, geocode_status, geocoded_at) are refused BY NAME rather than ignored: they record where THIS PLATFORM resolved the address to and when, so a supplied one would assert a geocode that never ran and nothing downstream could tell it from a real result. The map pin and the store-wide locator settings are refused for the same reason they are not published: they configure a rendered widget rather than describe a shopfront. The slug is unique per store, and a deleted location keeps holding its slug, so a retry past the idempotency window answers 409 slug_taken instead of minting a second shopfront at the same address.

slug
string
required

The storefront URL segment, lowercase kebab-case. Required rather than derived from the name: this API does not invent an identifier a merchant will see in a URL. It is MUTABLE, which is why the detail route keys on the id.

name
string
required
address_line_1
string
required
city
string
required
country_code
string
required

Two letters. Stored and served EXACTLY as sent, with no case normalisation anywhere in the write path.

address_line_2
string | null
region
string | null
postal_code
string | null
phone
string | null
email
string | null
website_url
string | null
hours
object

The merchant's opening-hours map, deliberately opaque: no schema, no canonical key set, no validation. It publishes exactly what the merchant typed rather than pretending to a structure the write path never enforced. A consumer needing schema.org openingHours maps it.

custom_fields
object

A free-form merchant-authored bag. It is safe to publish only while every writer is merchant input, so internal state belongs in a new field and never in here.

tags
string[]

The merchant's own locator filter chips.

is_active
boolean

Defaults to true. false hides the location from the storefront locator while keeping the row, and it is the REVERSIBLE withdrawal that the delete qualifier exists so integrations do not need.

position
integer

Display order for the locator. 0 is a real ordinal rather than an absence, so a store that never reordered anything reads as all zeroes.

Response

Created

data
object