Replace a storefront template's draft markup
Replaces the DRAFT markup. Shoppers keep seeing the published copy until you publish, so this is safe to run against a live store all day. THE WHOLE DOCUMENT REPLACES THE STORED DRAFT. There is no merge and no partial update: markup is a document, and merging two of them field by field produces one neither writer intended. expected_updated_at IS REQUIRED, and this is the field the family is built around. A template carries no record of who wrote it: the row is keyed (store_id, name) with no created_by and no owner_app_id, so if you and another integration both author “product”, nothing in the data can tell your document from theirs. The version is the only thing that can. Send null only when you believe the store has no template of this name at all; otherwise send the updated_at you last read. A mismatch is 409 template_modified, and the fix is always the same: re-read, re-apply your change, re-send. The markup is validated on the way in, against a stricter gate for chrome kinds than for pages, and a refusal names the construct it refused.
Authorizations
A secret API key. Publishable keys cannot reach this API. A key may carry an expiry, and an expired key is refused exactly like an unknown one, with a 401 that names no reason; check the key's expires_at in the dashboard rather than inferring it from a response. When a merchant rolls a key's secret they choose a grace window of up to 3 days, and for its duration BOTH the new secret and the one it replaced authenticate, so an integration moves over on its own deploy schedule instead of at the instant the button is pressed. Move before the window closes: after it, the old secret is refused. Nothing else about this contract moves with a roll. The key keeps its id and its scopes, so the only thing an integration updates is the credential itself.
Headers
A unique key per logical write. Replaying a request with the same key returns the first response byte for byte instead of applying the write twice.
Path Parameters
Body
BOTH KEYS ARE REQUIRED and neither is defaulted. An omitted draft_markup would mean an empty template rather than an unchanged one, and defaulting expected_updated_at would make the unsafe write the easy one. published_markup, published, name, store_id, chrome and updated_at are refused BY NAME rather than ignored, so a client that tried to change the live storefront directly is told instead of being answered 200 while nothing happened.
The whole template, which REPLACES the stored draft. It is validated on the way in against the same gate that guards the rendered page, and against a stricter one for chrome kinds; a refusal is 400 invalid_markup naming the construct. Nothing here reaches a shopper until you publish.
The updated_at you last read. NULL asserts that this store has no template of this name, which is the only way a first write can name a version that does not exist; it is refused the moment a row does exist, so it cannot be used to skip the check. A mismatch is 409 template_modified. Nothing on this resource records an author, so this is the only thing that can tell two writers of one name apart.
Response
Success
