How AI is applied across API Evangelist and APIs.io. Read my AI disclosure →
API Evangelist API Evangelist
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC
Discovery
Learnings
Guidance
Toolbox
Alignment
API Evangelist LLC

Need help?

Contact us
Virto Commerce

Virto Commerce VirtoCommerce Platform API

B2B Innovation Platform

Documentation Provider Profile APIs.io OpenAPI GitHub

Virto Commerce VirtoCommerce Platform API is one of 13 APIs that Virto Commerce publishes on the APIs.io network, described by a machine-readable OpenAPI specification.

Tagged areas include VirtoCommerce Platform. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and a GitHub repository.

This API exposes 124 operations across 106 paths, and defines 91 schemas. It is described by OpenAPI 3.0.4, at version v1.

Requests are made against the base URL https://virtostart-demo-admin.govirto.com/api.

124 operations 106 paths 91 schemas 9 DELETE52 GET59 POST4 PUT

Metadata

The identity and technical contract details declared by the specification.

Specification
OpenAPI 3.0.4
API Version
v1
Base URL
https://virtostart-demo-admin.govirto.com/api
Authentication
OAuth 2.0, API Key, API Key, HTTP Signature, HTTP Basic
Resource Areas
1

Authentication & Security 5

Virto Commerce VirtoCommerce Platform API declares 5 security schemes for authenticating requests. It supports OAuth 2.0 (oauth2) using the password and clientCredentials flows. An API key is passed in the query as api_key (api_key). An API key is passed in the header as api_key (api_key_header). It uses HTTP signature authentication (http-signature). It accepts HTTP basic authentication (basic).

  • oauth2 — OAuth2 Resource Owner Password Grant flow
  • api_key — API Key authentication
  • api_key_header — API Key authentication (alternative via header)
  • http-signature — HTTP Signature authentication using Authorization header
  • basic — Basic authentication using username and password

Paths & Operations 124

Across 106 paths, the API surfaces 124 operations — 9 DELETE, 52 GET, 59 POST, 4 PUT. Each is listed below with its method, path, parameters, and response codes.

VirtoCommerce Platform 124

B2B Innovation Platform

GET
/externalsignin
ExternalSignIn_SignIn 5 params → 200
GET
/externalsignin/signout
ExternalSignIn_SignOut 2 params → 200
GET
/externalsignin/callback
ExternalSignIn_SignInCallback 1 param → 200
GET
/externalsignin/providers
ExternalSignIn_GetExternalLoginProviders → 200
GET
/api/apps/{appId}/manifest
Returns the host app's plugin manifest. In production: cacheable — responds 304 on matching If-None-Match. The descriptor is built and hashed once at the service layer (VirtoCommerce.Platform.Core.Mo…
AppManifest_GetManifest 1 param → 200
POST
/api/apps/manifest/invalidate
Force-invalidate the manifest cache for every appId. The next call to GET /api/apps/{appId}/manifest will rebuild the descriptor from disk, picking up any plugin changes since the last build (new mod…
AppManifest_InvalidateManifestCache → 204401403
GET
/api/platform/apps
Gets the list of available apps, filtered by user permissions.
Apps_GetApps → 200
POST
/revoke/token
Authorization_RevokeCurrentUserToken → 200
POST
/connect/token
Authorization_Exchange body → 200400
GET
/connect/authorize
Authorization_Authorize → 200
POST
/connect/authorize
Authorization_Authorize → 200
GET
/connect/userinfo
Authorization_Userinfo → 200
POST
/connect/userinfo
Authorization_Userinfo → 200
GET
/connect/logout
Authorization_Logout → 200
POST
/api/changes/force
Force set changes last modified date
ChangeLog_ForceChanges 1 param → 204401403
POST
/api/platform-cache/reset
ChangeLog_ResetPlatformCache → 204401403
GET
/api/changes/lastmodifieddate
Get last modified date for given scope Used for signal of what something changed and for cache invalidation in external platform clients
ChangeLog_GetLastModifiedDate 1 param → 200
POST
/api/changes/changed-entities
ChangeLog_GetChangedEntities body → 200
POST
/api/changes/changed-entities/reset
ChangeLog_ResetChangedEntities body → 204401403
POST
/api/platform/changelog/search
ChangeLog_SearchChanges body → 200401403
POST
/api/platform/changelog/v2/search
ChangeLog_SearchChangesV2 body → 200401403
GET
/api/platform/changelog/{type}/changes
ChangeLog_SearchTypeChangeHistory 3 params → 200401403
GET
/api/platform/developer-tools
DeveloperTools_GetDeveloperTools → 200401403
GET
/api/platform/diagnostics/systeminfo
Diagnostics_GetSystemInfo → 200401403
GET
/api/platform/diagnostics/errors
Get installed modules with errors
Diagnostics_GetModulesErrors → 200
GET
/api/platform/dynamic/types
Get object types which support dynamic properties
DynamicProperties_GetObjectTypes → 200401403
GET
/api/platform/dynamic/properties
DynamicProperties_GetAllDynamicProperties 1 param → 200401403
POST
/api/platform/dynamic/properties
Add new dynamic property
DynamicProperties_CreatePropertyAsync body → 200401403
PUT
/api/platform/dynamic/properties
Update existing dynamic property
DynamicProperties_UpdatePropertyAsync body → 204401403
DELETE
/api/platform/dynamic/properties
Delete dynamic property
DynamicProperties_DeletePropertyAsync 1 param → 204401403
POST
/api/platform/dynamic/properties/search
Get dynamic properties registered for object type
DynamicProperties_SearchDynamicProperties body → 200401403
POST
/api/platform/dynamic
Does nothing. Just a way to expose DynamicObjectProperty thru Swagger.
DynamicProperties_ExposeDynamicObjectProperty → 200204401403
GET
/api/platform/dynamic/dictionaryitems
DynamicProperties_GetAllDictionaryItems 1 param → 200401403
POST
/api/platform/dynamic/dictionaryitems
Add or update dictionary items
DynamicProperties_SaveDictionaryItemsAsync body → 204401403
DELETE
/api/platform/dynamic/dictionaryitems
Delete dictionary items
DynamicProperties_DeleteDictionaryItemAsync 1 param → 204401403
POST
/api/platform/dynamic/dictionaryitems/search
Get dictionary items
DynamicProperties_SearchDictionaryItems body → 200401403
GET
/api/platform/jobs/{id}
Get background job status
Jobs_GetStatus 1 param → 200401403
GET
/api/platform/localizable-settings
LocalizableSettings_GetSettingsAndLanguages → 200401403
GET
/api/platform/localizable-settings/{name}/dictionary-items/{language}/values
LocalizableSettings_GetDictionaryValues 2 params → 200401403
POST
/api/platform/localizable-settings/{name}/dictionary-items
LocalizableSettings_SaveDictionaryItems 1 param body → 204401403
DELETE
/api/platform/localizable-settings/{name}/dictionary-items
LocalizableSettings_DeleteDictionaryItems 2 params → 204401403
POST
/api/platform/modules/reload
Reload modules
Modules_ReloadModules → 204401403
GET
/api/platform/modules
Get installed modules
Modules_GetModules → 200401403
POST
/api/platform/modules/getdependents
Get all dependent modules for a module
Modules_GetDependingModules body → 200401403
POST
/api/platform/modules/getmissingdependencies
Returns a flat expanded list of modules that depend on passed modules
Modules_GetMissingDependencies body → 200401403
POST
/api/platform/modules/localstorage
Upload module package for installation or update
Modules_UploadModuleArchive → 200400401403
POST
/api/platform/modules/install
Install modules
Modules_InstallModules body → 200401403
POST
/api/platform/modules/install/v2
Install modules using lightweight requests
Modules_InstallModuleRequests body → 200401403
POST
/api/platform/modules/update
Update modules
Modules_UpdateModules body → 200401403
POST
/api/platform/modules/update/v2
Update modules using lightweight requests
Modules_UpdateModuleRequests body → 200401403
POST
/api/platform/modules/uninstall
Uninstall module
Modules_UninstallModule body → 200401403
POST
/api/platform/modules/uninstall/v2
Uninstall modules using lightweight requests
Modules_UninstallModuleRequests body → 200401403
POST
/api/platform/modules/restart
Restart web application
Modules_Restart → 204401403
POST
/api/platform/modules/autoinstall
Auto-install modules with specified groups
Modules_TryToAutoInstallModules → 200401403
GET
/api/platform/modules/loading-order
Get module loading order
Modules_GetModulesLoadingOrder → 200401403
GET
/api/platform/modules/{moduleId}/versions/{version}/validate
Validate that a specific module version package exists at the download URL.
Modules_ValidateModuleVersion 2 params → 200401403
POST
/api/platform/modules/{moduleId}/versions/{version}/install
Install a specific version of a module. Validates the package URL, registers the custom version, and schedules installation.
Modules_InstallModuleVersion 2 params → 200404401403
POST
/api/platform/modules/{moduleId}/install
Install the latest available version of a module.
Modules_InstallModule 1 param → 200401403
POST
/api/platform/modules/{moduleId}/uninstall
Uninstall a module.
Modules_UninstallSingleModule 1 param → 200401403
GET
/api/platform/oauthapps/new
OAuthApps_New → 200401403
POST
/api/platform/oauthapps
OAuthApps_SaveAsync body → 200401403
DELETE
/api/platform/oauthapps
OAuthApps_DeleteAsync 1 param → 200401403
POST
/api/platform/oauthapps/search
OAuthApps_SearchAsync body → 200401403
POST
/api/platform/pushnotifications
SearchAsync push notifications
PushNotification_SearchPushNotification body → 200401403
POST
/api/platform/pushnotifications/markAllAsRead
Mark all notifications as read
PushNotification_MarkAllAsRead → 200401403
POST
/api/platform/security/users/{userId}/sessions/search
Security_SearchUserSessions 1 param body → 200401403
DELETE
/api/platform/security/users/{userId}/sessions/{id}
Security_TerminateUserSession 2 params → 204401403
DELETE
/api/platform/security/users/{userId}/sessions
Security_TerminateAllUserSessions 1 param → 204401403
POST
/api/platform/security/login
Sign in with user name and password
Security_Login body → 200
GET
/api/platform/security/logout
Sign out
Security_Logout → 204
GET
/api/platform/security/currentuser
Get current user details
Security_GetCurrentUser → 200
GET
/api/platform/security/userinfo
Security_Userinfo → 200401403
GET
/api/platform/security/permissions
Get all registered permissions
Security_GetAllRegisteredPermissions → 200401403
POST
/api/platform/security/roles/search
SearchAsync roles by keyword
Security_SearchRoles body → 200401403
GET
/api/platform/security/roles/{roleName}
Get role by ID
Security_GetRole 1 param → 200401403
DELETE
/api/platform/security/roles
Delete roles by ID
Security_DeleteRoles 1 param → 204401403
PUT
/api/platform/security/roles
Update an existing role or create new
Security_UpdateRole body → 200401403
POST
/api/platform/security/users/search
SearchAsync users by keyword
Security_SearchUsers body → 200401403
GET
/api/platform/security/users
Get users by IDs
Security_GetUsersByIds 1 param → 200401403
PUT
/api/platform/security/users
Update user details by user ID
Security_Update body → 200401403
DELETE
/api/platform/security/users
Delete users by name
Security_Delete 1 param → 200401403
GET
/api/platform/security/users/{userName}
Get user details by user name
Security_GetUserByName 1 param → 200401403
GET
/api/platform/security/users/id/{id}
Get user details by user ID
Security_GetUserById 1 param → 200401403
GET
/api/platform/security/users/email/{email}
Get user details by user email
Security_GetUserByEmail 1 param → 200401403
GET
/api/platform/security/users/login/external/{loginProvider}/{providerKey}
Get user details by external login provider
Security_GetUserByLogin 2 params → 200401403
POST
/api/platform/security/users/create
Create new user
Security_Create body → 200401403
POST
/api/platform/security/currentuser/changepassword
Change password for current user.
Security_ChangeCurrentUserPassword body → 200400401403
POST
/api/platform/security/users/{userName}/changepassword
Change password
Security_ChangePassword 1 param body → 200400401403
POST
/api/platform/security/users/{userName}/resetpassword
Reset password confirmation
Security_ResetPassword 1 param body → 200401403
POST
/api/platform/security/users/{userId}/resetpasswordconfirm
Reset password confirmation
Security_ResetPasswordByToken 1 param body → 200
POST
/api/platform/security/users/{userId}/validatepasswordresettoken
Validate password reset token
Security_ValidatePasswordResetToken 1 param body → 200
POST
/api/platform/security/users/{loginOrEmail}/requestpasswordreset
Send email with instructions on how to reset user password.
Security_RequestPasswordReset 1 param → 200
POST
/api/platform/security/validatepassword
Security_ValidatePassword body → 200
POST
/api/platform/security/validateuserpassword
Security_ValidateUserPassword body → 200401403
GET
/api/platform/security/users/{id}/locked
Checks if user locked
Security_IsUserLocked 1 param → 200401403
GET
/api/platform/security/passwordchangeenabled
Checks if manual password change is enabled
Security_PasswordChangeEnabled → 200401403
POST
/api/platform/security/users/{id}/lock
Lock user
Security_LockUser 1 param → 200401403
POST
/api/platform/security/users/{id}/unlock
Unlock user
Security_UnlockUser 1 param → 200401403
GET
/api/platform/security/users/{id}/apikeys
Security_GetUserApiKeys 1 param → 200401403
POST
/api/platform/security/users/apikeys
Security_SaveUserApiKey body → 200401403
PUT
/api/platform/security/users/apikeys
Security_UpdateUserApiKey body → 200401403
DELETE
/api/platform/security/users/apikeys
Security_DeleteUserApiKeys 1 param → 200401403
GET
/api/platform/security/logintypes
Get allowed login types
Security_GetLoginTypes → 200
POST
/api/platform/security/users/{userId}/sendVerificationEmail
Verify user email
Security_SendVerificationEmail 1 param → 200401403
POST
/api/platform/security/users/{userId}/confirmEmail
Security_ConfirmEmail 1 param body → 200401403
GET
/api/platform/security/users/{userId}/generateChangeEmailToken
Security_GenerateChangeEmailToken 2 params → 200401403
GET
/api/platform/security/users/{userId}/generateEmailConfirmationToken
Security_GenerateEmailConfirmationToken 1 param → 200401403
GET
/api/platform/security/users/{userId}/generatePasswordResetToken
Security_GeneratePasswordResetToken 1 param → 200401403
GET
/api/platform/security/users/{userId}/generateToken
Security_GenerateUserToken 3 params → 200401403
POST
/api/platform/security/users/{userId}/verifyToken
Security_VerifyUserToken 1 param body → 200401403
GET
/api/platform/settings
Get all settings
Setting_GetAllGlobalSettings → 200401403
POST
/api/platform/settings
Update settings values
Setting_UpdateAsync body → 204401403
GET
/api/platform/settings/modules/{id}
Get settings registered by specific module
Setting_GetGlobalModuleSettingsAsync 1 param → 200401403
GET
/api/platform/settings/{name}
Get setting details by name
Setting_GetGlobalSettingAsync 1 param → 200401403
GET
/api/platform/settings/ui/customization
Get UI customization setting
Setting_GetUICustomizationSetting → 200
GET
/api/platform/settings/v2/global/schema
Get global settings schema (metadata only, no values)
SettingsV2_GetGlobalSchema 2 params → 200401403
GET
/api/platform/settings/v2/global/values
Get global settings values as a flat { name: value } dictionary. Optional moduleId narrows the response to a single module's settings — same filter as M:VirtoCommerce.Platform.Web.Controllers.Api.Set…
SettingsV2_GetGlobalValues 2 params → 200401403
POST
/api/platform/settings/v2/global/values
SettingsV2_SaveGlobalValues 1 param body → 204401403
GET
/api/platform/settings/v2/tenant/{tenantType}/schema
Get tenant settings schema (metadata only, no values). Schema depends only on tenantType registration, not on a specific tenant instance.
SettingsV2_GetTenantSchema 3 params → 200401403
GET
/api/platform/settings/v2/tenant/{tenantType}/{tenantId}/values
Get tenant settings values as a flat { name: value } dictionary. Optional moduleId narrows the response to a single module's settings.
SettingsV2_GetTenantValues 4 params → 200401403
POST
/api/platform/settings/v2/tenant/{tenantType}/{tenantId}/values
SettingsV2_SaveTenantValues 3 params body → 204401403
GET
/api/platform/settings/v2/me/schema
Get the current user's UserProfile settings schema (metadata only). Schema is the same for every user — it's defined by the platform's UserProfile-tenant registration. Optionally filter by moduleId s…
SettingsV2_GetMeSchema 2 params → 200401403
GET
/api/platform/settings/v2/me/values
Get the current user's effective UserProfile settings values as a flat { name: value } dictionary. Optional moduleId narrows the response to a single module's per-user settings — same filter M:VirtoC…
SettingsV2_GetMeValues 2 params → 200401403
POST
/api/platform/settings/v2/me/values
SettingsV2_SaveMeValues 1 param body → 204401403

Schemas 91

The contract defines 91 schemas that model the data the API accepts and returns. The most detailed are ApplicationUser (32 properties), JsonWebKey (27 properties), UserSearchCriteria (24 properties), ModuleDescriptor (21 properties). Each schema is shown below with its type and property counts.

DynamicPropertyDictionaryItem
object
8 properties
AppManifestResponse
object
Response shape for GET /api/apps/{appId}/manifest. Returns the host app metadata plus a topologically ordered, permission-filtered list of plugins the host sho…
4 properties
UserLockedResult
object
1 property
PushNotificationSearchCriteria
object
15 properties
ChangeLogSearchResult
object
2 properties
IdentityResult
object
2 properties
SecurityResult
object
2 properties
Job
object
3 properties
RoleSearchCriteria
object
11 properties
OperationLog
object
9 properties
DynamicPropertyDictionaryItemSearchResult
object
2 properties
PushNotificationSearchResult
object
3 properties
ModuleDescriptor
object
21 properties
AppDescriptor
object
8 properties
DeveloperToolDescriptor
object
5 properties
OpenIddictApplicationDescriptor
object
14 properties
ResetPasswordConfirmRequest
object
2 properties
ModuleInstallRequest
object
2 properties
ModulePushNotification
object
14 properties
ObjectSettingEntry
object
20 properties
ContentFile
object
One asset belonging to a plugin (script, stylesheet, etc.). Carries the information a client-side loader needs to build the right HTML element with proper cach…
3 properties
ResetPasswordRequest
object
2 properties
Permission
object
5 properties
DynamicPropertyValueType
string
UserApiKey
object
9 properties
ApplicationUser
object
32 properties
SemanticVersion
object
4 properties
JsonWebKey
object
27 properties
CryptoProviderCache
object
LastModifiedResponse
object
2 properties
JsonWebKeySet
object
4 properties
JsonValueKind
string
LocalizableSetting
object
3 properties
ApplicationUserLogin
object
2 properties
Claim
object
7 properties
ClaimsIdentity
object
9 properties
LocalizedValue
object
2 properties
Role
object
6 properties
PushNotification
object
9 properties
ProgressMessage
object
2 properties
UserSessionSearchResult
object
2 properties
LocalizableSettingsAndLanguages
object
2 properties
PermissionScope
object
3 properties
UserSearchResult
object
3 properties
ChangedEntitiesResponse
object
1 property
JsonElement
object
1 property
SortInfo
object
2 properties
ModuleAutoInstallPushNotification
object
14 properties
LoginType
object
4 properties
ProgressMessageLevel
string
UserSessionSearchCriteria
object
12 properties
DynamicPropertyName
object
2 properties
DynamicPropertySearchResult
object
2 properties
UserSearchCriteria
object
24 properties
SignInResult
object
4 properties
RoleSearchResult
object
3 properties
OpenIddictResponse
object
19 properties
ChangeLogSearchCriteria
object
14 properties
PluginEntry
object
One plugin contribution to a host app, returned by GET /api/apps/{appId}/manifest.
5 properties
OAuthAppSearchResult
object
2 properties
UserDetail
object
9 properties
LoginRequest
object
3 properties
ConfirmEmailRequest
object
1 property
UserSession
object
6 properties
PluginRemote
object
Module Federation remote coordinates for a plugin. Mirrors the shape expected by @module-federation/runtime.
2 properties
SettingPropertySchema
object
13 properties
OAuthAppSearchCriteria
object
11 properties
KeyValue
object
2 properties
DynamicPropertyDictionaryItemName
object
2 properties
ChangedEntitiesRequest
object
2 properties
AppPlacement
string
ExternalSignInProviderInfo
object
3 properties
CryptoProviderFactory
object
4 properties
DynamicPropertyObjectValue
object
8 properties
DynamicObjectProperty
object
17 properties
EntryState
string
DictionaryItem
object
2 properties
DynamicProperty
object
15 properties
DynamicPropertySearchCriteria
object
12 properties
SettingValueType
string
ModuleIdentity
object
3 properties
License
object
5 properties
VerifyTokenRequest
object
3 properties
ChangePasswordRequest
object
3 properties
SortDirection
string
IdentityError
object
2 properties
ValidatePasswordResetTokenRequest
object
1 property
ICryptoProvider
object
DynamicPropertyDictionaryItemSearchCriteria
object
12 properties
SystemInfo
object
9 properties
ChangedEntity
object
2 properties

Specification

The full machine-readable OpenAPI contract behind this narrative.

Source

virto-commerce-virtocommerce-platform-api-openapi.yml Raw ↑

Other APIs Virto Commerce publishes across the network.

Virto Commerce Catalog API
AE Profile APIs.io
Virto Commerce Companies and Contacts API
AE Profile APIs.io
Virto Commerce Inventory API
AE Profile APIs.io
Virto Commerce Marketing API
AE Profile APIs.io
Virto Commerce Order Management API
AE Profile APIs.io
Virto Commerce Pricing API
AE Profile APIs.io
Virto Commerce Quotes API
AE Profile APIs.io
Virto Commerce Shopping Cart API
AE Profile APIs.io
Virto Commerce Store API
AE Profile APIs.io
Virto Commerce Webhooks API
AE Profile APIs.io
Virto Commerce Event Bus API
AE Profile APIs.io
Virto Commerce Returns API
AE Profile APIs.io
#VirtoCommerce Platform
← Back to V APIs
API Details
ID
virto-commerce:virto-commerce-virtocommerce-platform-api
Base URL
https://virtostart-demo-admin.govirto.com/api
Docs
https://docs.virtocommerce.org/
Provider
Virto Commerce
APIs.io →  GitHub →
Explore more
All APIs Providers APIs.io Network
Work with this as data

Every API here is available over the API and to AI agents over MCP. APIs is not yet its own endpoint on the v1 API. Reach this content through network search and the tag graph, or the MCP server below.

Installs https://mcp.apievangelist.com/mcp in Claude, Cursor, VS Code and the rest — one button, every client.

MCP tools for apis
4 tools reach this content
  • search_api_evangelistSearch every content type across the network at once.
  • find_relatedThe shared-tag relevance graph — what else covers this.
  • get_tagEverything one tag labels, across all content types.
  • guide_topicPRO — a curated bundle for a topic: area, guidance, rules, papers, stories, services.
All tools & prompts
Call it yourself
curl for this page
Search the network for this 
curl "https://api.apievangelist.com/v1/search?q=virto-commerce-virtocommerce-platform-api&limit=10"
Everything under a tag 
curl "https://api.apievangelist.com/v1/tags/virto-commerce-virtocommerce-platform-api"

Discovery needs no key. Full bodies and the synthesis endpoints are Pro.

Get an API key

Free tier, no email required. Sign in with whichever identity you already have.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have. Your account

Where this information came from

This is an independent, third-party profile of Virto Commerce VirtoCommerce Platform API, published by API Evangelist. We do not operate, host, resell, or support these APIs, and we are not affiliated with or endorsed by the company unless stated above. Everything here is built from publicly available information — the company's own site, developer portal, documentation, public repositories, and the specifications it publishes for public use. Nothing is obtained by breaching a system, defeating an access control, or using credentials.

The Kin Score and Agent Readiness rating are independently calculated assessments of a company's public API artifacts, scored against a published rubric. They are not certifications, endorsements, security assessments, or audits.

Corrections, re-scores, and removal are free — no partnership or purchase required, and you do not need to justify the request. A removed company is recorded as unrated, never scored zero for having asked. Acknowledgement within one business day; removal within two.

info@apievangelist.com · Read the full data-sourcing policy →
On a security or compliance team? Put security in the subject line and you will get a person, not a form — we will tell you exactly which public URLs this profile was built from.