Developers & AI agents

Technical notes for developers and AI agents that talk to cloud-store-cbd.com. Everything below was checked against the live store on 25 October 2026. Base URL: https://www.cloud-store-cbd.com.

Overview

Cloud Store CBD is a French online shop selling legal CBD products: hemp-derived products with a THC content below 0.3 %, for adults aged 18 and over. The shop is run in Charente and sells online only.

This is not an API platform. The shop has no custom API, no developer programme and no partner portal. The interfaces described on this page are the standard interfaces that Shopify exposes on every storefront, plus the agent-discovery files that Shopify publishes for us. We document the ones we tested so that agents and developers do not have to guess. Product titles and descriptions returned by these interfaces are written in French, and prices are in euros.

Agent discovery

These public files help an agent understand the store before it calls anything:

/agents.md: instructions for AI agents on how to use the store.
/llms.txt: plain-text overview of the store for language models.
/.well-known/ucp: the store's UCP profile (Universal Commerce Protocol), maintained by Shopify. It lists the shopping capabilities (catalog search and lookup, cart, checkout) and an MCP endpoint hosted by Shopify, with its OpenRPC schema.
/.well-known/oauth-protected-resource: OAuth protected-resource metadata, see Authentication below.
/sitemap.xml: sitemap index (products, collections, pages, blog articles, in French and English).
/openapi.json: OpenAPI 3.1 description of the public read-only endpoints listed below.

For searching, building a cart and checking out on behalf of a user, prefer UCP over scraping the storefront. It is the supported agent path, and the checkout itself is run by Shopify.

Public read-only endpoints

These are the standard Shopify AJAX endpoints. They need no key and no account. The machine-readable description is in /openapi.json.

Method and path	Returns
`GET /products.json`	Paginated list of published products (`limit`, `page`).
`GET /collections.json`	List of published collections (`limit`).
`GET /collections/{handle}.json`	One collection.
`GET /collections/{handle}/products.json`	Products of one collection (`limit`, `page`).
`GET /products/{handle}.js`	One product, AJAX product object with variants.
`GET /products/{handle}.json`	One product, REST-style envelope.
`GET /search/suggest.json`	Predictive search (`q`, `resources[type]`, `resources[limit]`).
`GET /cart.js`	Current anonymous cart, tied to the visitor session cookie.
`POST /cart/add.js`	Adds variants to the anonymous cart (JSON body).

Examples

One product (answers 200, Content-Type: text/javascript, JSON body):

curl https://www.cloud-store-cbd.com/products/mousseux-cbn.js

Product list, collections and one collection:

curl "https://www.cloud-store-cbd.com/products.json?limit=2"
curl "https://www.cloud-store-cbd.com/collections.json?limit=3"
curl https://www.cloud-store-cbd.com/collections/best-sellers.json
curl "https://www.cloud-store-cbd.com/collections/best-sellers/products.json?limit=2"
curl https://www.cloud-store-cbd.com/products/mousseux-cbn.json

Predictive search (-g turns off curl's bracket globbing):

curl -g "https://www.cloud-store-cbd.com/search/suggest.json?q=mousseux&resources[type]=product&resources[limit]=2"

Cart. Use a cookie jar so that the cart persists between calls, and take VARIANT_ID from variants[].id of a product object:

curl -c jar.txt -b jar.txt -X POST https://www.cloud-store-cbd.com/cart/add.js \
  -H "Content-Type: application/json" \
  -d '{"items":[{"id":VARIANT_ID,"quantity":1}]}'
curl -c jar.txt -b jar.txt https://www.cloud-store-cbd.com/cart.js

These endpoints cannot place an order. Checkout is handled by Shopify, see Authentication.

Authentication

The public endpoints above need no authentication: no API key, no token, no OAuth scopes.
The shop does not issue API keys and does not offer a sandbox or test environment, so there is nothing to sign up for or request. Use the live public endpoints as they are.
Authorisation for UCP and checkout is handled by Shopify. The file /.well-known/oauth-protected-resource names Shopify's authorisation server and says that bearer tokens are sent in the Authorization header. It does not define scopes.

Errors

Errors come from Shopify and are not customised by the shop. Observed responses:

Unknown variant on POST /cart/add.js

Status 422, Content-Type: application/json:

{"status":422,"message":"Cart Error","description":"Cannot find variant"}

Missing query on /search/suggest.json

Status 422, JSON body:

{"status":422,"message":"Invalid parameter error","description":"param is missing or the value is empty: q"}

Unknown product handle

/products/{handle}.js and /products/{handle}.json answer 404 with an empty body. Test the status code, not the body.

Markdown requests

Product, collection and page URLs answer 404 when the request carries Accept: text/markdown. This is a known Shopify behaviour. Send Accept: text/html (or no Accept header) for pages, or use the JSON endpoints above. /llms.txt and /agents.md are served as text/markdown.

Rate limits

Rate limiting is applied by Shopify, not by the shop. The responses carry no RateLimit headers, so there is no documented request budget. If you receive 429, wait and retry with exponential backoff (for example 1 s, 2 s, 4 s, 8 s, with some jitter), and avoid crawling the whole catalogue in a tight loop. /sitemap.xml is the better starting point for a full crawl.

Versioning & changes

Shopify's AJAX API is not versioned. Responses may change without a version bump, so ignore fields you do not know.
/openapi.json carries its own version in info.version (currently 1.0.0), and its description states when the responses were observed (24 October 2026). It is updated when an observed response changes.
There is no changelog feed and no notice period beyond whatever Shopify itself provides. The UCP profile at /.well-known/ucp lists the protocol versions that the store supports.

Legal & compliance

Products are for adults aged 18 and over only. Do not build flows that sell to minors.
The hemp products sold here contain less than 0.3 % THC, in line with French regulation.
Nothing returned by these interfaces is medical advice. Product data describes products, not effects on a person.
Delivery is to metropolitan France only. Orders ship within 24 hours, and the carrier's delivery time comes on top.
Legal pages: legal notice, terms of sale, privacy policy.

Contact

Questions about this page or a response that does not match what is documented: contact@cloud-store-cbd.com. This address also receives customer mail, so please do not send credentials or personal data.