Every endpoint below was called against live production (api.platformdtc.com) with a real scoped sq_agt_* service-account key. This is not a test-suite summary — it is what the production API actually returned. The keys used were minted for the sweep and revoked immediately afterwards; revocation was itself verified (a revoked key returns AUTHENTICATION_ERROR). Last verified: 2026-07-21.
Only read endpoints were exercised. Writes were deliberately not run against live merchant data — creating or mutating products, orders or customers in a real store is not an acceptable test. Write paths are covered by the unit and db-e2e suites, not by this sweep.

​
Agent Gateway — /api/v1/agent/v1

Scope enforcement was confirmed negatively as well: a key without ads:read got 403 FORBIDDEN_SCOPE on /ads/accounts, and a key without agent:admin got 403 on /audit and /webhooks. The gate is real, not decorative.

​
Commerce resource APIs — /api/v1

These are the endpoints whose scopes were, until recently, impossible to mint — they were enforced by the Go services but missing from the scope registry, so no sq_agt_* key could carry them. All now verified reachable with a scoped key.

​
MCP surface

Verified against the running mcp-platformdtc server (reachable only from the OpenClaw runtime and localhost — it is IP-locked, so this was exercised on the host):
  • tools/list → 25 tools advertised
  • tools/call dtc_list_orders → returned live order data through the Gateway
Every advertised tool is routed; there are no advertised-but-uncallable tools on this deployment.

​
Known broken

GET /ads/accounts returns 500 on every call. The route passes a store_id argument to IntegrationService.get_connected_accounts, which does not accept one — the call raises TypeError before it can return. Reproduced live with a correctly-scoped key.The same handler also declares a platform query parameter and never forwards it, so that filter is silently ignored.No agent tool points at this endpoint, so no agent can currently reach the failure. Do not add one until the handler is fixed.

​
Not yet available

  • /api/v1/products does not accept X-Agent-Key — with two exceptions. The listing, variant, image and bulk routes still return 401 Missing or invalid authorization header for agent keys and serve the dashboard user JWT only; that cutover is the pending work described in Products. Until it lands, use the Gateway’s /products routes, which are agent-accessible but narrower. The exceptions are POST /api/v1/products/import/shopify and .../import/shopify/preview (recipe), which do accept X-Agent-Key and back dtc_import_shopify_product / dtc_preview_shopify_product. They are served by the Go binary rather than Python, which is why their auth differs from their path neighbours. Scope is write_products (legacy catalog:write keys are equivalent).
  • The offer-optimize surface is not deployed to production. Its routes and service are absent from the deployed build, so the offers:* scopes can be granted but have nothing to authorize yet.