Wishlists

These endpoints are called from a shopper's browser, so they take your publishable key rather than a secret one. Anything specific to one customer also takes a signed email and timestamp: see Identifying the customer for how to produce the signature.

GET /widgets/wishlists/for-product

List the current customer's wishlists plus whether each contains a product. The customer parameters are optional here: with the publishable key alone it returns the store's wishlist settings and an empty list, which is how the widget renders for a shopper who is not signed in

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)

The signed-in shopper's address. Leave it out for a shopper who is not signed in.

timestampstring

The Unix seconds the signature was made at. Required with customerEmail.

signaturestring

The HMAC of the email and timestamp. Required with customerEmail.

productSlugstringrequired

Slug of the product. On Shopify this is the product handle.

Request
curl \
  "https://api.cascade.dev/widgets/wishlists/for-product?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&productSlug=string"
Response
{
  "productSlug": "string",
  "productFound": true,
  "wishlists": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "name": "string",
      "itemsCount": 0,
      "shared": true,
      "shareUrl": "https://example.com",
      "shareToken": "string",
      "isDefault": true,
      "createdAt": "2025-01-15T09:30:00Z",
      "updatedAt": "2025-01-15T09:30:00Z",
      "hasProduct": true,
      "productItemId": "550e8400-e29b-41d4-a716-446655440000"
    }
  ],
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true,
  "defaultWishlistName": "string"
}

POST /widgets/wishlists/claim

Move the lists a shopper saved in their browser before signing in onto their customer record. When the store allows several lists, each browser list becomes a new wishlist and a name that is already taken gets a numbered suffix. When it keeps one list per customer, everything flattens into the default list. An item already on the target list is left exactly as it is. The whole claim succeeds or fails together, so the browser can keep its copy until the response confirms the merge

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

listsobject[]required

The lists the shopper built in their browser before signing in.

Request
curl \
  -X POST \
  "https://api.cascade.dev/widgets/wishlists/claim?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "lists": [
    {
      "name": "string",
      "items": [
        "..."
      ]
    }
  ]
}'
Response
{
  "wishlists": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "name": "string",
      "itemsCount": 0,
      "shared": true,
      "shareUrl": "https://example.com",
      "shareToken": "string",
      "isDefault": true,
      "createdAt": "2025-01-15T09:30:00Z",
      "updatedAt": "2025-01-15T09:30:00Z"
    }
  ],
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true,
  "claimedLists": 0,
  "claimedItems": 0,
  "skippedItems": 0
}

POST /widgets/wishlists/upload-url

Get a link to upload a customer's own photo of a saved item. PUT the file's bytes to uploadUrl, then send key as imageKey when updating the item. Photos only, at most 5 MB, checked again once the bytes land. Refused while the store has photos on saved items switched off. Rate limited per address

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

fileNamestringrequired

The file's name, kept for the dashboard.

contentTypeimage/jpeg | image/png | image/webp | image/gifrequired

The file's MIME type. Photos only: JPEG, PNG, WebP or GIF.

sizeBytesnumberrequired

The file's size in bytes. Photos can be at most 5 MB.

Request
curl \
  -X POST \
  "https://api.cascade.dev/widgets/wishlists/upload-url?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "fileName": "string",
  "contentType": "image/jpeg",
  "sizeBytes": 0
}'
Response
{
  "key": "string",
  "uploadUrl": "string",
  "expiresAt": "2025-01-15T09:30:00Z"
}

GET /widgets/wishlists/banner

What a product page shows when somebody arrives from a shared wishlist link carrying cascadeWishlist and cascadeItem: the shopper's photo and note for that item, whose list it is, and a link to the whole list. No customer signature is needed. The answer is null whenever there is nothing to show: the list is private or sharing is off, the item is not this product, or it carries neither a photo nor a note

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

shareTokenstringrequired

The cascadeWishlist value from the link the shopper arrived on.

itemIdstring (uuid)required

The cascadeItem value from the same link.

productSlugstringrequired

Slug of the product the page is showing. The banner only answers for a match.

Request
curl \
  "https://api.cascade.dev/widgets/wishlists/banner?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&shareToken=string&itemId=550e8400-e29b-41d4-a716-446655440000&productSlug=string"
Response
{
  "banner": {
    "imageUrl": "string",
    "note": "string",
    "ownerFirstName": "string",
    "wishlistName": "string",
    "shareUrl": "https://example.com"
  }
}

POST /widgets/wishlists/default/toggle-item

Toggle a product on the customer's default wishlist, creating the default list on first use

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

productSlugstringrequired

Slug of the product. On Shopify this is the product handle.

Request
curl \
  -X POST \
  "https://api.cascade.dev/widgets/wishlists/default/toggle-item?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "productSlug": "string"
}'
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "added": true,
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

GET /widgets/wishlists

List the current customer's wishlists. The customer parameters are optional here: with the publishable key alone it returns the store's wishlist settings and an empty list, which is how the widget renders for a shopper who is not signed in

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)

The signed-in shopper's address. Leave it out for a shopper who is not signed in.

timestampstring

The Unix seconds the signature was made at. Required with customerEmail.

signaturestring

The HMAC of the email and timestamp. Required with customerEmail.

Request
curl \
  "https://api.cascade.dev/widgets/wishlists?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY"
Response
{
  "wishlists": [
    {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "name": "string",
      "itemsCount": 0,
      "shared": true,
      "shareUrl": "https://example.com",
      "shareToken": "string",
      "isDefault": true,
      "createdAt": "2025-01-15T09:30:00Z",
      "updatedAt": "2025-01-15T09:30:00Z"
    }
  ],
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true,
  "defaultWishlistName": "string"
}

POST /widgets/wishlists

Create a new wishlist

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

namestringrequired

What the customer called the wishlist.

Request
curl \
  -X POST \
  "https://api.cascade.dev/widgets/wishlists?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string"
}'
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

GET /widgets/wishlists/{id}

Get a wishlist with its items

Path Parameters

idstring (uuid)required

The ID of the wishlist.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Request
curl \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..."
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

PATCH /widgets/wishlists/{id}

Update a wishlist's settings: its name or whether it is shared

Path Parameters

idstring (uuid)required

The ID of the wishlist.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

namestring

A new name for the wishlist.

sharedboolean

Turns the wishlist's share link on or off.

isDefaultboolean

Makes this wishlist the customer's default for one-click saves. Send false to leave the customer without a default.

Request
curl \
  -X PATCH \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "name": "string",
  "shared": true,
  "isDefault": true
}'
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

DELETE /widgets/wishlists/{id}

Delete a wishlist

Path Parameters

idstring (uuid)required

The ID of the wishlist.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Request
curl \
  -X DELETE \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..."
Response
{
  "id": "550e8400-e29b-41d4-a716-446655440000"
}

POST /widgets/wishlists/{id}/share-token

Generate a new share token for a wishlist, invalidating the old share link

Path Parameters

idstring (uuid)required

The ID of the wishlist.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Request
curl \
  -X POST \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000/share-token?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..."
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

POST /widgets/wishlists/{id}/items

Add an item to a wishlist

Path Parameters

idstring (uuid)required

The ID of the wishlist.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

productSlugstringrequired

Slug of the product. On Shopify this is the product handle.

productVariantIdstring (uuid) | null

The variant the customer chose, or null to save the product as a whole.

quantityinteger | null

How many of this item the customer wants. Leave it out if they did not say.

notestring

A short note about this item, such as a size or color preference.

Request
curl \
  -X POST \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000/items?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "productSlug": "string",
  "productVariantId": "550e8400-e29b-41d4-a716-446655440000",
  "quantity": 0,
  "note": "string"
}'
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

PATCH /widgets/wishlists/{id}/items/{itemId}

Update an item's quantity, note or photo, or move it to another of the customer's wishlists

Path Parameters

idstring (uuid)required

The ID of the wishlist the item is on.

itemIdstring (uuid)required

The ID of the wishlist item.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Body Parameters

quantityinteger | null

How many of this item the customer wants. Send null to clear it.

notestring

A short note about this item, such as a size or color preference. Send an empty string to clear it.

imageKeystring | null

The key from POST /widgets/wishlists/upload-url, to attach the customer's own photo to the item. It replaces any photo already there. Send null to take the photo off. Refused while the store has photos on saved items switched off.

wishlistIdstring (uuid)

Moves the item to this wishlist, which must belong to the same customer. Any quantity or note edits in the same request are applied first. If the target list already has the same product and variant, the two entries merge: the target entry stays, keeps its quantity, and the moved item's note is appended to its note.

Request
curl \
  -X PATCH \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000/items/550e8400-e29b-41d4-a716-446655440000?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..." \
  -H "Content-Type: application/json" \
  -d '{
  "quantity": 0,
  "note": "string",
  "imageKey": "string",
  "wishlistId": "550e8400-e29b-41d4-a716-446655440000"
}'
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}

DELETE /widgets/wishlists/{id}/items/{itemId}

Remove an item from a wishlist

Path Parameters

idstring (uuid)required

The ID of the wishlist the item is on.

itemIdstring (uuid)required

The ID of the wishlist item.

Query Parameters

apiPublishableKeystringrequired

Your organization's publishable key, from Settings, API keys.

customerEmailstring (email)required

Email address of the customer the storefront signed in.

timestampstringrequired

Unix time in seconds when the signature was generated. It is accepted for 24 hours.

signaturestringrequired

Hex HMAC-SHA256 of customerEmail followed by timestamp, keyed with your widget signing secret. See the widgets guide for the recipe.

Request
curl \
  -X DELETE \
  "https://api.cascade.dev/widgets/wishlists/550e8400-e29b-41d4-a716-446655440000/items/550e8400-e29b-41d4-a716-446655440000?apiPublishableKey=pk_YOUR_PUBLISHABLE_KEY&customerEmail=shopper%40example.com&timestamp=1735689600&signature=9f86d081..."
Response
{
  "wishlist": {
    "id": "550e8400-e29b-41d4-a716-446655440000",
    "name": "string",
    "itemsCount": 0,
    "shared": true,
    "shareUrl": "https://example.com",
    "shareToken": "string",
    "isDefault": true,
    "createdAt": "2025-01-15T09:30:00Z",
    "updatedAt": "2025-01-15T09:30:00Z",
    "items": [
      {
        "id": "...",
        "productId": "...",
        "productVariantId": "...",
        "quantity": "...",
        "note": "...",
        "imageUrl": "...",
        "purchasedQuantity": "...",
        "createdAt": "...",
        "product": "...",
        "variant": "..."
      }
    ]
  },
  "sharingEnabled": true,
  "multipleWishlists": true,
  "itemImagesEnabled": true
}