EyesAsia developer portal

The EyesAsia REST API exposes current storefront catalog data and the authenticated operations used by the EyesAsia web application. The production API base URL is https://sunglasses-api.onrender.com. Use the published OpenAPI 3.0 document as the machine-readable source for operation identifiers, parameters, request bodies, response schemas, authentication requirements, and error formats.

Public quickstart

Public catalog reads do not require an account or API key. This request returns active products using the API's default pagination. Use documented query parameters to filter and sort results.

curl --request GET --url "https://sunglasses-api.onrender.com/products" --header "Accept: application/json"

Useful public operations include GET /products, GET /products/{id}, GET /products/filter-options, GET /lens-packages, and GET /homepage. Calls may be rate limited. Read RateLimit-Limit, RateLimit-Remaining, and RateLimit-Reset on API responses so your client can self-throttle. A rejected request also includes Retry-After; the legacy X-RateLimit-* fields remain available for compatibility.

Authentication and permissions

Customer and staff operations use a short-lived EyesAsia bearer access token obtained through the first-party account authentication flow. Send it in the Authorization: Bearer <token> header. Staff operations are additionally checked against role permissions such as catalog read/write, orders read/update, content management, support, marketing, and user administration. The protected-resource metadata endpoint lists the machine-readable permission names.

Current limitation: EyesAsia does not yet operate an OAuth 2.0 authorization server for third-party clients, issue self-service API keys, provide a public sandbox, or publish an official CLI. Do not automate password entry or claim OAuth support. Those capabilities require separate product and security decisions.

Errors and safe automation

API errors are JSON and include a stable code, human-readable message, resolution hint, and request identifier. Agents should read before writing, ask for explicit user confirmation before state-changing operations, avoid retrying validation failures unchanged, and use backoff when rate limited or temporarily unavailable. Never log access tokens, refresh cookies, passwords, prescription details, or payment information.

Resources

OpenAPI JSON · OpenAPI YAML · Protected-resource metadata · Agent instructions · Sitemap · Contact EyesAsia