Reviews
These endpoints are called from a shopper's browser, so they take your publishable key rather than a secret one. Anything specific to one customer also takes a signed email and timestamp. Identifying the customer explains how to produce the signature.
To call them from your own server instead, send a secret key as a bearer token and leave apiPublishableKey out. See Calling the widget API from a server.
GET /widgets/reviews
Get paginated published reviews, either for one product or, with no product slug, from across the whole store. Send the customer trio for a signed-in shopper and reviewForm says whether they can write a review here.
Query parameters
apiPublishableKeystringYour organization's publishable key, from Settings, API keys. Leave it out when the request carries a secret key as a bearer token instead, which is how a server calls these endpoints.
productSlugstringSlug of the product whose reviews to list. Leave it out to list published reviews from across the whole store, which is what a store-wide carousel shows.
productExternalIdstringThe product's ID on one of your sites, such as its Shopify product ID, sent instead of productSlug. Either Shopify form works.
sitestringThe slug of the site productExternalId belongs to. Only needed when the same ID is on more than one of your sites.
limitnumberHow many reviews to return.
cursorstringThe nextCursor from the previous page.
sortnewest | highest | lowest | helpfulOrder of the review list: newest first, highest or lowest rating first, or most helpful votes first. Defaults to newest, for one product and across the whole store alike.
ratingintegerShow only reviews with this star rating. The rating breakdown still covers them all.
minRatingintegerShow only reviews rated this many stars or higher. The rating breakdown covers them all.
voterTokenstringThe visitor's vote token, used to mark the reviews they have already voted on.
customerEmailstring (email)The signed-in shopper's address. Leave it out for a shopper who is not signed in.
timestampstringThe Unix seconds the signature was made at. Required with customerEmail.
signaturestringThe HMAC of the email and timestamp. Required with customerEmail.
POST /widgets/reviews
Submit a review of a product from the storefront. The review goes into moderation like any other: published in the answer says whether it is live already, which only happens when the store auto-publishes reviews at that rating. A review from a signed-in shopper (the customer trio) with an order for the product that was not canceled is marked as a verified buyer; a guest's review, identified by the email in the body, never is. When the store only accepts reviews from verified buyers, anyone else gets a 403 whose message says why, and reviewForm on GET /widgets/reviews tells the widget beforehand. It is rate limited per IP address.
Query parameters
apiPublishableKeystringYour organization's publishable key, from Settings, API keys. Leave it out when the request carries a secret key as a bearer token instead, which is how a server calls these endpoints.
customerEmailstring (email)The signed-in shopper's address. Leave it out for a shopper who is not signed in.
timestampstringThe Unix seconds the signature was made at. Required with customerEmail.
signaturestringThe HMAC of the email and timestamp. Required with customerEmail.
Body parameters
productSlugstringSlug of the product being reviewed. Send this or productExternalId.
productExternalIdstringThe product's ID on one of your sites, such as its Shopify product ID, sent instead of productSlug. Either Shopify form works.
sitestringThe slug of the site productExternalId belongs to. Only needed when the same ID is on more than one of your sites.
ratingintegerrequiredThe star rating, from 1 to 5.
titlestring | nullThe review's headline.
bodystring | nullThe review itself.
reviewerNamestring | nullThe reviewer's name. Only the first name and the last initial are ever shown, the same as every other review.
emailstring (email)The reviewer's email address. It is never shown on the storefront: it identifies the reviewer for moderation, and stops the same person reviewing one product twice. Ignored when the shopper is signed in, because the signed email is used instead.
fileKeysstring[]Keys from POST /widgets/reviews/upload-url for the photos and videos to attach, up to five.
renderedAtnumberUnix time in milliseconds when the form was opened, used to measure time to submit. A review that comes back instantly is flagged for a person to look at.
honeypotFilledbooleanTrue when the form's hidden trap field was filled in, which only a bot does.
answersobject[]Answers to the extra questions this product's form asked, from questions on GET /widgets/reviews. Every question marked required has to be answered.
GET /widgets/reviews/media
Get paginated photos and videos from published reviews, either for one product or, with no product slug, from across the whole store
Query parameters
apiPublishableKeystringYour organization's publishable key, from Settings, API keys. Leave it out when the request carries a secret key as a bearer token instead, which is how a server calls these endpoints.
productSlugstringSlug of the product whose photos and videos to show. Leave it out for a wall of media from across the whole store.
productExternalIdstringThe product's ID on one of your sites, such as its Shopify product ID, sent instead of productSlug. Either Shopify form works.
sitestringThe slug of the site productExternalId belongs to. Only needed when the same ID is on more than one of your sites.
limitnumberHow many media items to return. A review's own photos and videos are never split across pages, so a page can come back a little over this.
cursorstringThe nextCursor from the previous page.
minRatingintegerShow only media from reviews rated this many stars or higher.
POST /widgets/reviews/{id}/vote
Vote on whether a review was helpful. Voting again with the same voterToken replaces the earlier vote. It is rate limited per IP address.
Path parameters
idstringrequiredThe ID of the review being voted on.
Query parameters
apiPublishableKeystringYour organization's publishable key, from Settings, API keys. Leave it out when the request carries a secret key as a bearer token instead, which is how a server calls these endpoints.
Body parameters
helpfulbooleanrequiredTrue marks the review helpful, false marks it not helpful.
voterTokenstringrequiredRandom id identifying the visitor's browser. Voting again with the same token replaces the earlier vote.
POST /widgets/reviews/{id}/reports
Report a published review as fake, abusive or otherwise wrong, with one of five reasons and an optional note. The review is flagged for the store's staff to look at and stays published until a person decides. Reporting the same review again from the same IP address replaces the earlier report rather than adding another. It is rate limited per IP address.
Path parameters
idstringrequiredThe ID of the review being reported.
Query parameters
apiPublishableKeystringYour organization's publishable key, from Settings, API keys. Leave it out when the request carries a secret key as a bearer token instead, which is how a server calls these endpoints.
Body parameters
reasonfake | offensive | private_information | not_about_product | otherrequiredWhy the shopper reported the review: fake (looks fake or not from a real customer), offensive (offensive or abusive), private_information (shares someone's private information), not_about_product (not about this product) or other (something else).
notestring | nullAnything the shopper wants to add in their own words, up to 1,000 characters. Shown to the store's staff beside the reason, never on the storefront.
POST /widgets/reviews/upload-url
Get a short-lived link for uploading one photo or video to attach to a storefront review. PUT the file's bytes to uploadUrl, then send key in the review's fileKeys. It is rate limited per IP address.
Query parameters
apiPublishableKeystringYour organization's publishable key, from Settings, API keys. Leave it out when the request carries a secret key as a bearer token instead, which is how a server calls these endpoints.
Body parameters
fileNamestringrequiredThe file's name, kept for the moderation view.
contentTypeimage/jpeg | image/png | image/gif | image/webp | video/mp4 | video/quicktime | video/webmrequiredThe file's MIME type. Photos and videos only.
sizeBytesnumberrequiredThe file's size in bytes.