Headless API reference.

Connect any website or application to a Print Shop Command Center shop: read the catalog, get a server-computed quote, submit an order, check its status, and capture leads. Seven endpoints, one header, plain JSON.

1. What this is

Every shop on Print Shop Command Center can issue API keys from its own console. A key lets an outside system talk to that one shop: pull the products it sells, ask the shop's own pricing engine what a cart costs, and place an order against the resulting price. Prices are always computed on the server from the shop's configuration — a client sends products, quantities and options, never money. The shop is resolved from the key itself, so there is no shop id parameter anywhere in this API.

2. Base URL and authentication

All endpoints live under one base URL. Send your key in the X-Pscc-Key header on every request; header names are case-insensitive.

https://www.printshopcommandcenter.com/api/v1

curl https://www.printshopcommandcenter.com/api/v1/shop \
  -H "X-Pscc-Key: pscc_pk_00000000000000000000000000000000"

Keys come in two shapes, distinguishable by prefix:

Request bodies are JSON and must stay under 64 KiB. Include Content-Type: application/json on every POST.

3. Publishable keys vs secret keys

Publishable keys (pscc_pk_) are intended for browser code and are gated by an origin allowlist you set in the console. An empty allowlist allows any origin. A non-empty allowlist rejects any request that does not arrive with a permitted Origin header — and a server-to-server call sends no Origin at all, so using such a key from a backend fails with origin_not_allowed every time. The allowlist is not something a server call bypasses.

Secret keys (pscc_sk_) are for server-side code. They are never origin-gated, and they get an elevated read limit on the three read endpoints (see rate limits). Keeping a secret key off the browser is guidance we cannot technically enforce — nothing stops a secret key being pasted into front-end code, and nothing about the key itself will complain. If it can be seen by a visitor, treat it as compromised and revoke it.

4. The endpoints

GET /shop

Returns { "shop": { ... } }. This is where every shop-specific input for a quote lives: turnaround.standardBusinessDays and turnaround.rushTiers, fulfillment.pickup|delivery|shipping (each method with id, label, fee, appliesTo, active), checkout.fields, money, and catalog. Start here.

GET /products and GET /products/{style}

{ "products": [ ... ] } and { "product": { ... } }. Each entry carries style, name, colors, sizes, allowedMethods, allowedPlacements, maxPlacements, canQuote, contactOnly, contactHref, category, image and description. The product identity used everywhere in this API — the path segment, and productKey in a cart — is the public style, never a database id.

POST /quote

Body is a cart:

items

1 to 50 lines. Each: productKey (required), sizeRun (required, an object of size to whole-number quantity), color, placements (up to 20, each { key, artUploadId? }), method, colorCount (1-64), specialInstructions (up to 2000 characters).

fulfillment

Required. { group: "pickup" | "delivery" | "shipping", methodId } — both discovered from GET /shop.

turnaround

Required. { kind: "standard" } or { kind: "rush", tierId }.

Returns { "cart": { ... }, "reviewedPrice": { ... } }. The cart carries the priced lines, subtotals, tax, fulfillment fee, order charges, total and dueDate. The reviewedPrice object is a server-signed statement of the price you were shown; keep it and echo it back on submit.

POST /orders

Everything /quote takes, plus:

clientOperationId

Required. Your own idempotency key for this submit attempt. Retrying with the same id, the same guest token and identical content returns the original order at 200 with replayed: true instead of creating a second one.

reviewedPrice

Required in practice. Echo the object from /quote verbatim. This is the price-tamper precondition: the server re-prices the cart and refuses the submit if the two disagree.

guestCheckoutToken

Required in practice — see the note below.

customer

Required. { name, email, phone? }.

fulfillmentAddress

Required whenever the fulfillment group is delivery or shipping. { line1, line2?, city, region, postalCode, country }. A pickup order discards any address you send.

checkoutFields

Required whenever the shop configured any. One answer per field in checkout.fields, exactly once each.

notes

Optional. Up to 2000 characters.

Returns 201 with { orderId, orderNumber, trackingUrl, trackingToken, replayed } on a first submit, or 200 with replayed: true on a replay. trackingUrl and trackingToken can be null: issuing the tracking link is best-effort and never fails an order.

GET /orders/{trackingToken}

Returns shop, order, timeline, items, showPrices and jobProgress. Every refusal — malformed token, unknown token, a token belonging to another shop, a revoked token, or a shop with tracking switched off — returns the same uniform envelope with no message:

{
  "error": "not_found"
}

That is deliberate. The endpoint is not an oracle for probing which tokens exist.

POST /leads

Body: email (required), name, phone, selections (required — garmentPositionId, colorChoice as 1-12 or "FULL_COLOR", qty, plus optional locations, dark, turnaroundPositionId, personalization, namedLocations), and optional artworkReview. Returns 201 with { leadId }.

5. Building a cart that will actually price

Validation passing is not the same as pricing succeeding. The request schema is deliberately permissive; the shop's pricing engine is not. These are the rules a client has to follow to get past it:

• Skip contactOnly products entirely. They cannot be quoted.
• Use only the sizes, allowedMethods and allowedPlacements a product actually exposes, and respect maxPlacements. Size keys are matched case-sensitively. A product with no configured sizes accepts exactly one key: OS.
• Supply method whenever the product allows more than one and nothing in the request implies a choice. The server refuses to guess.
• Supply colorCount on every line that resolves to screen printing. It is mandatory whether you named screen yourself or the engine resolved it. Screen is the most common method in a print shop, so in practice most lines need it.
• Answer every field in checkout.fields exactly once, with a response whose kind matches the field's.
• Supply fulfillmentAddress whenever the chosen fulfillment group is delivery or shipping.
• Read fulfillment methods fresh from GET /shop. A method can be inactive, or restricted by appliesTo to a set of products that does not cover your whole cart.

Every rejection you can provoke

The list below is the complete set of refusals on the quote and order path, enumerated from the pricing and submission code rather than summarised. It is grouped by what you can do about it.

6. Errors

Every error is the same envelope: a stable error code and an optional human-readable message. Treat message as display copy that may change; branch on error and the HTTP status.

{
  "error": "validation_failed",
  "message": "Review every checkout question and try again."
}

7. Rate limits

Per key, per minute:

Order submission and lead capture also carry a parallel per-IP bucket scoped to the shop, so a leaked publishable key cannot spread abuse across arbitrary clients.

Separately, and independently of any key, there is a ceiling of 240 requests per minute per IP that is charged before the key is looked up. It can return 429 for a request carrying a missing or invalid key.

Responses carry X-RateLimit-Limit and X-RateLimit-Remaining, plus Retry-After on a 429 only. There is no X-RateLimit-Reset. All three are named in Access-Control-Expose-Headers, so browser clients can read them.

Rate headers are absent from four specific responses, because they are decided before any per-endpoint bucket is consulted: 401 invalid_key, 403 origin_not_allowed, and both shop_unavailable forms (403 and 503). The pre-auth 429 is not in that group — it carries all three.

8. CORS

Preflight (OPTIONS) requests are unauthenticated — browsers do not send custom headers on a preflight, so these validate syntax only and return 204 with Content-Type and X-Pscc-Key allowed. Authentication and the origin allowlist gate the actual request.

On the actual response, Access-Control-Allow-Origin echoes your Origin when a publishable key's allowlist permits it, and is * when the allowlist is empty. Secret-key responses echo Origin when one is present. Credentials are never allowed, and every response is Cache-Control: private, no-store.

9. Worked example

A complete pass: read the shop, price a cart, submit it, track it. Every id below is illustrative. Fulfillment method ids, product styles, turnaround tiers and checkout field ids are all per-shop configuration — a hard-coded methodId will fail against any other shop. Discover current values from GET /shop on each run rather than persisting the ones printed here.

Step 1 — GET /shop

curl https://www.printshopcommandcenter.com/api/v1/shop \
  -H "X-Pscc-Key: pscc_sk_000000000000000000000000000000000000000000000000"

Abridged to the fields this example uses:

{
  "shop": {
    "_public": true,
    "profile": {
      "name": "Your Print Shop"
    },
    "money": {
      "symbol": "$",
      "code": "USD"
    },
    "turnaround": {
      "standardBusinessDays": 10,
      "rushOffered": true,
      "rushTiers": [
        {
          "withinDays": 5,
          "feePct": 25
        },
        {
          "withinDays": 8,
          "feePct": 10
        }
      ]
    },
    "fulfillment": {
      "pickup": [
        {
          "id": "pickup-counter",
          "label": "Pick up at the shop",
          "fee": 0,
          "appliesTo": "all",
          "active": true
        }
      ],
      "delivery": [],
      "shipping": [
        {
          "id": "ship-ups-ground",
          "label": "UPS Ground",
          "fee": 14.5,
          "appliesTo": "all",
          "active": true
        }
      ]
    },
    "checkout": {
      "fields": [
        {
          "id": "artwork-ok",
          "label": "Artwork approval",
          "kind": "agreement",
          "required": true,
          "text": "I approve the artwork as supplied and understand print colours may vary slightly."
        }
      ]
    },
    "catalog": [
      {
        "style": "5000",
        "name": "Gildan 5000 Heavy Cotton Tee",
        "colors": [
          "White",
          "Black",
          "Safety Orange",
          "Navy",
          "Red"
        ],
        "sizes": [
          "S",
          "M",
          "L",
          "XL",
          "2XL",
          "3XL"
        ],
        "allowedMethods": [
          "screen",
          "dtg",
          "dtf"
        ],
        "allowedPlacements": [
          "front",
          "back",
          "left_chest",
          "left_sleeve",
          "right_sleeve"
        ],
        "maxPlacements": 4,
        "canQuote": true
      }
    ]
  }
}

That response is what supplies the next request: a quotable product style, its sizes, colours and allowed methods; an active fulfillment group and methodId; the turnaround settings; and the checkout question that must be answered at submit.

withinDays: 5  (+25%)  ->  tierId: "rush-5"
withinDays: 8  (+10%)  ->  tierId: "rush-8"

Step 2 — POST /quote

One screen-printed line. Note colorCount: without it this exact request is refused, because the line resolves to screen.

curl -X POST https://www.printshopcommandcenter.com/api/v1/quote \
  -H "X-Pscc-Key: pscc_sk_000000000000000000000000000000000000000000000000" \
  -H "Content-Type: application/json" \
  -d '{
  "items": [
    {
      "productKey": "5000",
      "color": "Black",
      "sizeRun": {
        "M": 12,
        "L": 24,
        "XL": 12
      },
      "placements": [
        {
          "key": "front"
        }
      ],
      "method": "screen",
      "colorCount": 2
    }
  ],
  "fulfillment": {
    "group": "shipping",
    "methodId": "ship-ups-ground"
  },
  "turnaround": {
    "kind": "standard"
  }
}'

The response is { "cart": { ... }, "reviewedPrice": { ... } }. Show cart.total and cart.dueDate to the customer; keep reviewedPrice untouched for the next step.

Step 3 — POST /orders

The same cart, plus identity, idempotency and the echoed price. fulfillmentAddress is present because the fulfillment group is shipping; checkoutFields answers the one question the shop configured; guestCheckoutToken is a UUID v4 this client generated itself.

curl -X POST https://www.printshopcommandcenter.com/api/v1/orders \
  -H "X-Pscc-Key: pscc_sk_000000000000000000000000000000000000000000000000" \
  -H "Content-Type: application/json" \
  -d '{
  "items": [
    {
      "productKey": "5000",
      "color": "Black",
      "sizeRun": {
        "M": 12,
        "L": 24,
        "XL": 12
      },
      "placements": [
        {
          "key": "front"
        }
      ],
      "method": "screen",
      "colorCount": 2
    }
  ],
  "fulfillment": {
    "group": "shipping",
    "methodId": "ship-ups-ground"
  },
  "turnaround": {
    "kind": "standard"
  },
  "clientOperationId": "order-2026-07-19-0001",
  "guestCheckoutToken": "3f2504e0-4f89-41d3-9a0c-0305e82c3301",
  "reviewedPrice": "<paste the reviewedPrice object from the /quote response, verbatim>",
  "customer": {
    "name": "Dana Whitfield",
    "email": "dana@example.com",
    "phone": "555-0142"
  },
  "fulfillmentAddress": {
    "line1": "742 Press Ave",
    "city": "Sandy",
    "region": "UT",
    "postalCode": "84070",
    "country": "USA"
  },
  "checkoutFields": [
    {
      "id": "artwork-ok",
      "kind": "agreement",
      "checked": true
    }
  ],
  "notes": "Please pack the XLs separately."
}'

Replace the reviewedPrice string with the object /quote returned, unchanged. On success you get 201:

{
  "orderId": "0f2b1c74-1f4c-4f2e-9c0a-6d1b2e3f4a5b",
  "orderNumber": 1042,
  "trackingUrl": "https://example-shop.printshopcommandcenter.com/qq/track/Ab3...",
  "trackingToken": "Ab3...",
  "replayed": false
}

Step 4 — GET /orders/{trackingToken}

curl https://www.printshopcommandcenter.com/api/v1/orders/Ab3... \
  -H "X-Pscc-Key: pscc_sk_000000000000000000000000000000000000000000000000"

The token is scoped to the key's own shop. A token from another shop returns the same not_found envelope as a token that does not exist.

10. Troubleshooting

Everything returns 401 invalid_key

Check the obvious first: the header name is X-Pscc-Key, the key must be the full raw string shown once at creation (not the truncated prefix the console lists afterwards), and a revoked key stops working immediately. But there is a second cause that looks identical: if the headless API is not yet enabled on the platform, every key returns 401 invalid_key, because the key lookup itself cannot resolve. If a freshly created key fails on its first ever call, ask the shop to confirm the API is switched on before hunting for a bug in your client.

I am getting 429s

Back off on any 429. Which bucket you hit is identifiable from the value of X-RateLimit-Limit:

• 240 — the pre-auth per-IP ceiling. Charged before the key is read, so even an invalid key can be limited this way. Usually means one host is making far too many calls, not that your key is over quota.
• 120 / 60 / 30 / 5 — a per-endpoint bucket. Compare it against the rate-limit table to see which one.

Both share the same envelope and the same three header names. Only the limit value distinguishes them, and the pre-auth 429 does carry all three headers — its rate headers are not missing.

My quote returns 400 validation_failed

Read the message. The pricing engine names the specific problem — the product, the size, the method, the minimum quantity, or the colour capacity. Then check the rejection catalog: if the condition is in the shop-configuration group, no change to your request will fix it and the shop owner has to act.

My order returns 409 with a stale price

The cart is re-priced at submit and compared against the reviewedPrice you echoed. This fires when the shop's pricing changed between the two calls, and equally when your own request changed — the comparison covers items, methods, colour counts, placements, fulfillment and turnaround, not just the total. Re-run /quote with the current cart and submit the fresh reviewedPrice.

My order returns 400 about checkout questions

checkoutFields must contain exactly one answer per field in checkout.fields — no more, no fewer, no duplicates — and each answer's kind must match the field's. Omitting the key entirely counts as answering nothing, which fails for any shop with a required field. Dropdown values must be one of the field's current options, so re-read GET /shop rather than caching a question set indefinitely.

Manage keys in your shop console under Settings, API keys. Questions: integrations@printshopcommandcenter.com