Mint a cart checkout (public)
Checks out N cart lines — unique works and/or editioned formats — all-or-nothing: holds every unique work, verifies editioned stock, creates one sale + one multi-line invoice, and mints one Stripe Checkout session on the gallery's connected account (hosted redirect URL, or an embedded client secret with `ui_mode: embedded`). On a lost race nothing stays reserved and the 409's `details.lines` itemizes exactly which lines sold out (`reason: not_available | sold_out | drop_not_open`) so the storefront can retry with the rest. Authenticated with a `gpub_` publishable token; CORS-open, with the gallery's storefront origin allowlist enforced server-side when configured.
Checks out N cart lines — unique works and/or editioned formats — all-or-nothing: holds every unique work, verifies editioned stock, creates one sale + one multi-line invoice, and mints one Stripe Checkout session on the gallery's connected account (hosted redirect URL, or an embedded client secret with ui_mode: embedded). On a lost race nothing stays reserved and the 409's details.lines itemizes exactly which lines sold out (reason: not_available | sold_out | drop_not_open) so the storefront can retry with the rest. Authenticated with a gpub_ publishable token; CORS-open, with the gallery's storefront origin allowlist enforced server-side when configured.
Authorization
bearerAuth artworks:readA gallery API key, sent as Authorization: Bearer gpk_… (or the x-api-key header).
In: header
Scope: artworks:read
Header Parameters
Optional. Send a unique key per logical operation to make retries safe: a retry with the same key replays the stored success for 14 days instead of re-running the write. Reusing a key with a different body returns 400.
Request Body
application/json
TypeScript Definitions
Use the request body type in TypeScript.
A public cart checkout: N lines (unique works and/or editioned formats), reserved all-or-nothing. On a lost race nothing is reserved and the 409 details itemize exactly which lines sold out.
Response Body
application/json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
application/problem+json
{ "checkout_mode": "hosted", "checkout_url": "string", "client_secret": "string", "invoice_url": "string", "expires_at": "string"}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "code": "invalid_request", "retry": "permanent", "details": null}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "code": "invalid_request", "retry": "permanent", "details": null}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "code": "invalid_request", "retry": "permanent", "details": null}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "code": "invalid_request", "retry": "permanent", "details": null}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "code": "invalid_request", "retry": "permanent", "details": null}{ "type": "../dictionary", "title": "string", "status": 0, "detail": "string", "code": "invalid_request", "retry": "permanent", "details": null}List a gallery's available works (public) GET
The gallery's opt-in available works — the browser-safe read surface. Authenticated with a `gpub_` publishable token; CORS-open. Price appears only where the gallery publishes it.
List a gallery's public drops GET
The gallery's public drops — live state, window times, allocation mode, and public target identity — plus authoritative server time for an honest countdown. Authenticated with a `gpub_` publishable token; CORS-open. A drop appears only when its target work/room is already public.