eComm Pipes · Developers

eComm Pipes Developers

Build on eComm Pipes. The public REST API needs no sign-in and returns product-level data only. Seller work runs through the OAuth 2.1 protected MCP connector, where Walmart Marketplace changes need human approval.

Quickstart

No API key is needed for the public API.

curl -s https://ecommpipes.com/api/v1
curl -s https://ecommpipes.com/api/v1/marketplaces
curl -s "https://ecommpipes.com/api/v1/capabilities?limit=20"
curl -s https://ecommpipes.com/api/v1/status

Read the eComm Pipes OpenAPI 3.1 contract and the eComm Pipes REST API discovery document.

Endpoint reference

Endpoint	Returns	Auth
`GET /api/v1`	Version, authentication policy, endpoint URLs, MCP connector URL.	None
`GET /api/v1/marketplaces`	Walmart Marketplace (available) and vote options. A vote option is not a commitment.	None
`GET /api/v1/capabilities`	The seven MCP tools, action counts and a page of the action catalog. Parameters: `limit` (1–100), `cursor`, `primary_it`.	None
`GET /api/v1/status`	Service health without secrets.	None
`POST /register`	OAuth dynamic client registration (RFC 7591).	None
`POST /token`	OAuth token exchange and refresh.	PKCE / refresh token
`POST https://mcp.ecommpipes.com`	MCP streamable HTTP endpoint.	OAuth bearer token

Pagination: pass next_cursor back as cursor until it is null. Caching: every response has an ETag; send If-None-Match to get 304 Not Modified. CORS allows any origin.

OAuth 2.1 and scopes

The website origin is the authorization server: https://ecommpipes.com/authorize, https://ecommpipes.com/token and https://ecommpipes.com/register. S256 PKCE is required. Access tokens last 15 minutes and refresh tokens 7 days.

marketplace:account: Read this eComm Pipes account’s setup and connection status. No seller data and no Walmart Marketplace changes.
marketplace:read: Read Walmart Marketplace business data (catalog, inventory, listings, prices, orders) for the seller accounts you choose at consent.
marketplace:write: Prepare Walmart Marketplace changes and execute them once after required human approval in the browser. Requires marketplace:read.

Metadata: authorization server metadata and protected resource metadata (RFC 9728).

Client registration

Register with POST /register (dynamic client registration), or use an HTTPS URL that serves a client ID metadata document as your client_id. Registration is limited to 60 requests per minute per IP.

curl -s -X POST https://ecommpipes.com/register -H 'Content-Type: application/json' \
  -d '{"client_name":"My agent","redirect_uris":["http://127.0.0.1:8976/callback"],"token_endpoint_auth_method":"none"}'

MCP connector

Connector URL: https://mcp.ecommpipes.com. Claude Code: claude mcp add --transport http ecommpipes https://mcp.ecommpipes.com. Codex: codex mcp add ecommpipes --url https://mcp.ecommpipes.com, then codex mcp login ecommpipes.

Setup prompt to paste into your agent:

Set up the eComm Pipes MCP server (https://mcp.ecommpipes.com) so you can work on my Walmart Marketplace account. If you can run commands: in Claude Code, run "claude mcp add --transport http ecommpipes https://mcp.ecommpipes.com", then have me run /mcp to sign in. In Codex, run "codex mcp add ecommpipes --url https://mcp.ecommpipes.com", then "codex mcp login ecommpipes". If you are Claude in chat: walk me through Customize → Connectors → Add custom connector, name "eComm Pipes", URL https://mcp.ecommpipes.com, then Add, Connect, sign in and approve. Then call marketplace_overview to confirm and show me the welcome. Never ask me for Walmart API keys in chat. I enter them only in the secure eComm Pipes browser form.

See the MCP server card, llms.txt and setup guide.

Errors

Public API errors use application/problem+json (RFC 9457) with type, title, status, detail, instance and a stable code.

invalid_parameter (400): A query parameter or cursor is invalid. Fix the value and retry.
not_found (404): No public API resource exists at this path. Start from /api/v1.
method_not_allowed (405): The public API is read-only. Use GET.
rate_limited (429): Quota exhausted. Wait Retry-After seconds.
internal_error (500): The server could not build the response. Retry later.
service_degraded (503): A core dependency is unavailable. Retry after Retry-After seconds.

Rate limits

The public API allows 60 requests per 60 seconds per client IP. Every response carries IETF RateLimit and RateLimit-Policy headers. A 429 carries Retry-After. Cache with ETag to stay under the limit.

Versioning

The version is in the URL (/api/v1). Additive changes ship in place. A breaking change ships under a new URL version.

Deprecation

We announce a deprecated version at least 180 days before removal. Deprecated responses carry Deprecation and Sunset headers. Every response carries a Link header with rel="deprecation" to this policy.