REST and Store API integration

Use the API contracts when a custom storefront needs to expose the same account library or pass saved-configuration price consent through WooCommerce Blocks. The server still rebuilds every quote from current WooCommerce, Product Add-Ons, and Composite data.

These customer account and Store API contracts are registered only when Allow customers to save configurations to their accounts is enabled. The permission is disabled by default and does not affect public product preset URLs.

Account REST routes

The namespace is /wp-json/pom-tweaks/v1/saved-configurations.

• GET / lists records owned by the current customer with limit from 1 to 100 and a one-based page. Responses include X-WP-Total and X-WP-TotalPages headers.
• POST / validates and saves a Product Add-Ons or Composite intent.
• POST /from-cart captures a server-owned configured cart line by cart item key.
• GET /{configuration_uuid} reads an authorized record and returns an application object reconciled against the current product model.
• PATCH /{configuration_uuid} renames it.
• DELETE /{configuration_uuid} deletes it and its share links.
• POST /{configuration_uuid}/duplicate creates an owner copy.
• POST /{configuration_uuid}/shares creates one redacted bearer link with optional expiry and personalization consent.
• DELETE /{configuration_uuid}/shares/{share_uuid} revokes a link.
• POST /confirm returns a short-lived receipt for the currently reconciled price.

Account operations require an authenticated WordPress user, normal WordPress REST cookie authentication, and an X-WP-Nonce REST nonce for browser requests. Ownership or an applicable WooCommerce management capability is checked for every record mutation. This also supports network users who own an account record without holding a role on the individual multisite site. Every mutation body is limited to 64 KiB, configuration intent has bounded nesting, and account mutations are limited to 60 requests per minute per user. Price confirmation is limited to 20 requests per minute per user or WooCommerce guest session.

The version 1 configuration schema uses kind, product_id, optional variation_id, quantity, name, and a bounded intent object. Product Add-Ons intent is keyed by stable context and field UUIDs. Composite intent contains chapter selections and may contain nested Product Add-On UUID intent. Historical price values returned for display must never be submitted as authority. An account can hold up to 500 configurations, and each configuration can have up to 50 concurrently active links.

The resolved application contains current product and variation IDs, variation attributes, quantity, applicable intent, current display snapshot, reconciliation status and changes, and whether current-price confirmation is required. Use this object instead of replaying raw saved IDs.

Store API cart-item data

When WooCommerce Blocks loads cart items, the extensions.pom-saved-configurations object reports:

• saveable: whether the signed-in customer can capture that configured cart line.
• kind: product_addons, composite, or an empty string.

A custom client can send current-price consent when adding the reconciled item:

{
  "extensions": {
    "pom-saved-configurations": {
      "configuration_uuid": "00000000-0000-4000-8000-000000000000",
      "receipt": "short-lived-receipt"
    }
  }
}

The receipt is accepted only for the same configuration, resolved values, current calculated total, customer or guest session, and validity window. It is request-only, is not retained in cart item data, and is not a reusable price token.

Share-link boundary

Share tokens are opened through the generated link, not an enumerable REST record ID. A valid link establishes a short WooCommerce session context and redirects to the current product URL without leaving the token in the product-page address. Responses are marked non-cacheable and use a no-referrer policy.

An explicit pom_saved_configuration or preset query parameter has strict precedence. If that requested record is invalid, unavailable, or unauthorized, POM does not silently apply a different preset, filter-provided configuration, or earlier share session.

Verification

• Confirm that one customer cannot read, rename, delete, duplicate, share, or revoke another customer's record.
• Confirm that oversized and deeply nested payloads are rejected.
• Confirm that a revoked or expired link cannot establish or continue a shared context.
• Confirm that Blocks cart items expose only saveable and kind, not saved values or owner identifiers.
• Change a current price after obtaining a receipt and confirm that Store API add-to-cart rejects the stale receipt.