Agentic Fabriq
CloudCart
BUSINESS · COMMERCE & FINANCE
Products, orders, customers, and discounts in that store’s own admin.
Connect CloudCart with Fabriq Developer
Your user pastes their CloudCart credential on a page Agentic Fabriq hosts, so it never reaches your backend and never becomes one shared key across all of your users. Same call as OAuth, one more argument.
Provider names are surfaces, not vendors, and the authoritative list is the capabilities endpoint rather than any page including this one — an unknown name returns 400 with the valid list. Fabriq Developer is free to start and needs no provider paperwork. Start free or read the quickstart.
Connecting CloudCart in practice
CloudCart is a JSON:API implementation rather than a plain REST one, so filters, sparse fieldsets and includes come with the spec’s bracket syntax, and page[size] is capped at 100 against a default of 20. A 429 is documented but no threshold or reset window is, so the ceiling is only discoverable by hitting it.
Rate limits
- CloudCart documents "You will receive a 429: Too Many Requests response when you make too many requests" but publishes no numeric threshold or reset window.
- Pagination: page[number] and page[size], default page size 20, maximum 100.
Who has to approve
Keys are created, deleted, activated and deactivated by a store administrator at {your-store-domain}/admin/settings/api_keys, so access is granted and withdrawn in the store’s own admin rather than by the connecting user, and a key can be deactivated without being deleted.
Worth knowing
- The key travels in a vendor header, X-CloudCart-ApiKey, and a missing or invalid key returns 401 with {"status":"401","title":"Unauthenticated"} — no scopes are documented, so the key is all-or-nothing.
- Validation failures are 422, separate from 400 bad request, so the two have to be handled differently: one is retryable after a payload fix, one is not.
- Webhooks are an ordinary CRUD resource created through the API, which means an agent can register its own delivery endpoint but also silently inherit ones left behind by other integrations.
- Every listing response carries meta.page with last-page, which is the only reliable way to bound a walk given the undocumented rate ceiling.
Checked against CloudCart API authentication (2026-09-29), CloudCart API pagination (2026-09-29), CloudCart API errors (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put CloudCart behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.