Platform API

Your server uses the token from the installed event to access only that customer’s data for that plugin. Permissions are the ones in the manifest.

GET https://api.viswoo.com/api/v1/plugin/<code>/settings
Authorization: Bearer vzp_…

Endpoint	Method	Permission	Response
/api/v1/plugin/<code>/settings	GET	settings	Settings (server-only fields included)
/api/v1/plugin/<code>/data/<collection>	GET	data	[{ key, data, updatedAt }], by key, 100 per page (?after=<key>)
/api/v1/plugin/<code>/data/<collection>/<key>	GET, PUT, DELETE	data	The document; the PUT body is the document data (at most 64 KB)
/api/v1/plugin/<code>/events?days=30	GET	events	[{ date, name, count }]
/api/v1/plugin/<code>/codes	POST	codes	{ payload, days? } → code
/api/v1/plugin/<code>/codes/<value>	GET	codes	Code status

Errors come back with a { code } body (Error codes). An invalid token gives 401; if the customer turned the plugin off, plugin.not_installed; a missing permission, plugin.permission_denied.

const response = await fetch(`https://api.viswoo.com/api/v1/plugin/${code}/data/stats/quotes`, {
  method: 'PUT',
  headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ count: 12 }),
});

During development the simulator serves a subset of these endpoints at http://localhost:5199/api/v1/plugin/<code>/....