Public folders, media search, facets, or shareable-link reads
Public asset-library API
DAM public-read operation page using dam.enad.ioapp_id routes.
Management calls run with team/app context and a bearer token for the selected app. Keep them server-side. Auth calls are app-scoped before they act on identity or account state. Shopper REST covers existing public-read catalog compatibility; prefer Search GraphQL for new discovery, listing, facets, autocomplete, category, collection, and redirect work.
Use Management DAM for trusted folder administration, media placement, roles, operator search, and shareable-link administration. Use public asset-library routes only for folder, media, facet, and share-token reads through dam.enad.io app routes.
Use Events latest for webhook delivery, receiver design, retry behavior, delivery states, custom-header authentication, and webhook enabled_events values. Use Event catalog for exact event type strings, envelopes, schema IDs, and payload fields.
Use Integrations and Integrations reference for connector records, setup checks, sync jobs, sync status, and sync stop behavior. Keep connector configuration separate from webhook delivery.
Use Media to choose between DAM reads, asset records, and Image Proxy request-building. Media CDN transformations, validation ranges, response classes, delete cleanup behavior, and cache-purge requests are documented behavior. Cache-key construction, cache retention, edge freshness timing, purge completion timing, and every-edge invalidation are not public contracts.
Treat MCP as an orchestration and policy layer over Enad platform contracts. Do not use MCP as a shortcut around endpoint, schema, package, Search, or event references.
Use MCP server for hosted endpoint setup, OAuth discovery, public docs tools, delegated bearer authentication, supported scopes, context switching, capability discovery, and preview/apply behavior.
Capability status is the execution gate. Only implemented capabilities with concrete preview/apply tool names are executable write workflows. descriptor-only, deferred, blocked, and out-of-scope entries are discovery or proof-gate metadata.
MCP input fields are tool-input bounds, not raw REST request bodies. REST/OpenAPI reference remains endpoint truth for paths, fields, limits, status codes, and response shapes. Destructive or approval-backed changes need the MCP preview/apply lifecycle and post-apply verification through the owning read surface.
Use Search GraphQL latest for app-scoped Search GraphQL, GraphiQL, query shape, category or collection targeting, facets, autocomplete, Search documents, or Search-backed SDK behavior. For exact schema, operation, and fragment truth, open Search GraphQL reference latest, /graphql/search-schema.graphql, or /graphql/search-documents.graphql.
Keep app, market, store-group, and locale context explicit. Do not copy Search GraphQL filter objects into Shopper REST query strings. Package-provided Search work should start with @enadhq/enad-ts-sdk/search and createSearchClient(). Generated documents and types remain available when no named convenience method exists.
Choose the Enad API, Search, Events, Media, or MCP surface from the job. Verify exact endpoints in API/OpenAPI references, Search fields in Search reference, and event payloads in the Event catalog. Keep app, market, store-group, locale, auth, and runtime placement explicit. Use @enadhq/enad-ts-sdk/search and createSearchClient() for package-backed Search work when those helpers fit.
API route guide
# API route guide
Choose the Enad API, Search, Events, Media, or MCP surface from the job, then open the narrowest page that can verify the detail you need.
## Pick the route first
| Job | Open first |
| --- | --- |
| Storefront discovery, facets, autocomplete, or GraphiQL | [Search GraphQL latest](/search/latest). |
| Search schema fields, operation variables, enum values, or fragments | [Search GraphQL reference latest](/reference/search-graphql/latest). |
| REST method, path, auth, query, body, or response shape | The operation page for the matching API. |
| Webhook delivery, receiver behavior, event names, or payload schema IDs | [Events latest](/events/latest) and [Event catalog](/events/catalog). |
| DAM reads, asset records, or Image Proxy URL building | [Media](/media) or [DAM guide](/media/dam/latest). |
| MCP connection, scopes, context, capability discovery, or preview/apply tools | [MCP server](/ai/mcp-server). |
| Shopper-facing React composition | [React product listing and search](/react-sdk/latest/guides/product-listing-search). |
## Choose where work belongs
| Surface | Use it for | Check |
| --- | --- | --- |
| Management API | Trusted merchant administration and server-side writes. | Management reference. |
| Auth API | Customer identity and account-context state. | Auth reference. |
| Shopper API | Existing public REST catalog reads. Prefer Search for new discovery work. | Shopper reference. |
| Public asset library | Public `dam.enad.io` folder, media-search, and shareable-link reads. | DAM public-read reference. |
| Management DAM | Authenticated folder administration and shareable-link management. | Management DAM reference. |
| Integrations API | Connector records, setup checks, stats, and sync jobs. | Integrations reference. |
| Search GraphQL | App-scoped discovery queries, generated documents, and SDK Search helpers. | Search GraphQL reference and package docs. |
| Events | Webhook routing plus cataloged event names and schemas. | Event catalog. |
| Media/Image Proxy | CDN delivery, transformation parameters, and asset workflow routing. | Media guide and asset references. |
## REST request routing
For a REST API task:
1. Identify the matching API and operation.
2. Check the operation page or API spec before writing request/response code.
3. Keep auth, app context, locale, and runtime placement explicit.
4. Treat guide examples as routing help until a reference confirms the fields.
| Job | Use | Verify before shipping |
| --- | --- | --- |
| Trusted catalog, merchandising, orders, organizations, channels, warehouses, tax, DAM administration, or bulk writes | Management API | Management operation page. |
| Connector records, setup verification, stats, and sync jobs | Integrations API | Integrations operation page. |
| Existing public REST catalog reads | Shopper API | Deprecated REST compatibility reads only. Prefer Search GraphQL for new storefront discovery. |
| Customer identity, sessions, account-owned commerce state, attributes, files, users, or organisations | Auth API | Auth operation page. |
| Public folders, media search, facets, or shareable-link reads | Public asset-library API | DAM public-read operation page using `dam.enad.io` `app_id` routes. |
Management calls run with team/app context and a bearer token for the selected app. Keep them server-side. Auth calls are app-scoped before they act on identity or account state. Shopper REST covers existing public-read catalog compatibility; prefer Search GraphQL for new discovery, listing, facets, autocomplete, category, collection, and redirect work.
Use Management DAM for trusted folder administration, media placement, roles, operator search, and shareable-link administration. Use public asset-library routes only for folder, media, facet, and share-token reads through `dam.enad.io` app routes.
## Events and media boundary
Use [Events latest](/events/latest) for webhook delivery, receiver design, retry behavior, delivery states, custom-header authentication, and webhook `enabled_events` values. Use [Event catalog](/events/catalog) for exact event type strings, envelopes, schema IDs, and payload fields.
Use [Integrations](/integrations) and [Integrations reference](/reference/integrations) for connector records, setup checks, sync jobs, sync status, and sync stop behavior. Keep connector configuration separate from webhook delivery.
Use [Media](/media) to choose between DAM reads, asset records, and Image Proxy request-building. Media CDN transformations, validation ranges, response classes, delete cleanup behavior, and cache-purge requests are documented behavior. Cache-key construction, cache retention, edge freshness timing, purge completion timing, and every-edge invalidation are not public contracts.
## MCP architecture boundary
Treat MCP as an orchestration and policy layer over Enad platform contracts. Do not use MCP as a shortcut around endpoint, schema, package, Search, or event references.
Use [MCP server](/ai/mcp-server) for hosted endpoint setup, OAuth discovery, public docs tools, delegated bearer authentication, supported scopes, context switching, capability discovery, and preview/apply behavior.
## MCP write routing
Use MCP for governed changes after you know which API surface owns the resource.
| Work | First route | Verify exact contract |
| --- | --- | --- |
| Catalog metadata, taxonomy, attributes, relationships, markets, store groups, schedules, channels, redirects, or static listings | `search_capabilities` with `catalog`, `routing`, or `merchandising` namespaces | Management reference and the matching concept page. |
| Variant lifecycle, variant groups, base prices, warehouse stock, warehouses, or bundles | `search_capabilities` with `catalog` or `commerce` namespaces | [Products, variants, variant groups, prices, and stock](/start/concepts/products-variants-prices-and-stock), [Variant groups](/start/concepts/variant-groups), bundle references, and warehouse references. |
| DAM folders, shareable links, media placement, media metadata, upload URL generation, or media deletion | `search_capabilities` with `media` namespace | [Media](/media), [Asset library reads and DAM administration](/media/dam/latest), and DAM/media references. |
| Identity, organisations, customer-owned carts, wishlists, saved carts, customer files, roles, customer groups, or orders | `search_capabilities` with `identity` or `customer` namespaces | Auth, Management, customer-group, order, cart, wishlist, organisation, user, and merchant-user references. |
Capability status is the execution gate. Only `implemented` capabilities with concrete preview/apply tool names are executable write workflows. `descriptor-only`, `deferred`, `blocked`, and `out-of-scope` entries are discovery or proof-gate metadata.
MCP input fields are tool-input bounds, not raw REST request bodies. REST/OpenAPI reference remains endpoint truth for paths, fields, limits, status codes, and response shapes. Destructive or approval-backed changes need the MCP preview/apply lifecycle and post-apply verification through the owning read surface.
## Search GraphQL boundary
Use [Search GraphQL latest](/search/latest) for app-scoped Search GraphQL, GraphiQL, query shape, category or collection targeting, facets, autocomplete, Search documents, or Search-backed SDK behavior. For exact schema, operation, and fragment truth, open [Search GraphQL reference latest](/reference/search-graphql/latest), `/graphql/search-schema.graphql`, or `/graphql/search-documents.graphql`.
Keep app, market, store-group, and locale context explicit. Do not copy Search GraphQL filter objects into Shopper REST query strings. Package-provided Search work should start with `@enadhq/enad-ts-sdk/search` and `createSearchClient()`. Generated documents and types remain available when no named convenience method exists.
For shopper-facing PLP/search composition, open [React product listing and search](/react-sdk/latest/guides/product-listing-search).
## Prompt skeleton
```text
Choose the Enad API, Search, Events, Media, or MCP surface from the job. Verify exact endpoints in API/OpenAPI references, Search fields in Search reference, and event payloads in the Event catalog. Keep app, market, store-group, locale, auth, and runtime placement explicit. Use @enadhq/enad-ts-sdk/search and createSearchClient() for package-backed Search work when those helpers fit.
```