# Come See Come Sav Public API

Family-owned farm, feed, and pet supply storefront API for Bradenton / Manatee County.

## Base URL

`https://comeseecomesav.com`

## Public endpoints

| Method | Path | Notes |
|--------|------|-------|
| GET | `/api/catalog` | Catalog bootstrap |
| GET | `/api/catalog/products` | Paginated products (`limit`, `offset`, `category`) |
| GET | `/api/catalog/products/{idOrSlug}` | Product detail |
| GET | `/api/catalog/products/{id}/image` | Product image proxy |
| GET | `/api/storefront/experience` | Bulletins / promotions |
| GET | `/api/healthz` | Liveness |

## Authentication

Public catalog and experience routes do not require auth.

Customer account APIs under `/api/account/*` require:

```http
Authorization: Bearer <keycloak_access_token>
```

Identity provider (OIDC issuer):

`https://id.comeseecomesav.com/realms/customer`

Discovery:

- Protected resource metadata: `https://comeseecomesav.com/.well-known/oauth-protected-resource`
- OpenID configuration (proxied): `https://comeseecomesav.com/.well-known/openid-configuration`
- Authorization server metadata (proxied): `https://comeseecomesav.com/.well-known/oauth-authorization-server`

## Machine-readable catalog

- API Catalog (RFC 9727): `https://comeseecomesav.com/.well-known/api-catalog`
- OpenAPI: `https://comeseecomesav.com/.well-known/openapi/catalog.json`

## Crawl policy

See `https://comeseecomesav.com/robots.txt` (Content-Signal: `ai-train=no, search=yes, ai-input=yes`).