01 · Records and state owned
Products, categories, prices, inventory, customers, carts and quotes, orders, invoices, shipments, refunds, coupons, stores, and extension configuration.
Adobe
Adobe Commerce
Adobe Commerce is included because its catalog, customer, cart, order, and fulfillment APIs support operational interfaces, with materially different PaaS and SaaS access models.
Commerce & paymentsSystem of recordBYO-UI-ready platform
Concrete capability record
Data, retrieval, actions, identity, and operating limits
A field-by-field summary of what the reviewed first-party references actually support. Publisher update dates and BYO-UI review dates are shown separately below.
02 · Data you can retrieve
Query commerce objects through REST and GraphQL, subscribe to Adobe I/O events, and invoke synchronous webhooks for supported checkout and extension flows.
03 · Actions and write paths
Create and update supported catalog, customer, cart, order, fulfillment, and configuration resources; extend checkout, tax, payment, shipping, and totals workflows.
04 · Authentication and permissions
PaaS uses OAuth 1.0a integrations, administrator or customer bearer tokens, sessions, and ACL resources defined by webapi.xml and acl.xml. Commerce as a Cloud Service requires IMS tokens for user or server integrations.
05 · Monitoring, approval, and recovery
Payment, tax, order, inventory, customer-data, and checkout writes require strict idempotency, environment separation, approvals, and financial audit trails.
06 · Limits and caveats
PaaS and SaaS do not share one REST surface: Commerce as a Cloud Service exposes fewer endpoints, omits customer and guest REST APIs, and directs comparable storefront access to GraphQL.
First-party access
Documented surfaces
Adobe Commerce GraphQL ↗Adobe Commerce exposes GraphQL endpoints with queries and mutations for its PaaS and SaaS product variants. Schema, deployment model, authentication, store scope, API limits, and mutation consequences define the effective access boundary; this is GraphQL, not database SQL.Source: GraphQL overviewMCP / agent surface ↗First-party developer/documentation MCP; not tenant-operational providerAPI ↗Developer accessDeveloper docs ↗SDKs and platform guidanceEvents / extensions ↗Webhooks, apps, or extensionsProduct ↗Native platform experience
Agent access
MCP support
Developer-context onlyOfficial Adobe Commerce developer and App Builder MCP toolingCurrent developer tooling; not verified as a general tenant operations server
Support: Developer-context only
Read scope: Commerce documentation, APIs, code samples, extension migration, App Builder generation and storefront/customization workflows in development environments
Write scope: Write scope was not separately normalized in this pass; inspect the official tool catalog before enabling actions.
Authentication: PaaS supports OAuth 1.0a integrations and role-specific bearer tokens; Commerce as a Cloud Service uses IMS access tokens for interactive users or OAuth server-to-server credentials.
Approval boundary: Require explicit human confirmation for costly, externally visible, destructive, or hard-to-reverse actions.
Protocol does not erase product boundaries.
Confirm the current tool catalog, plan, region, scopes, rate limits, terms, and write behavior before implementation.
Editorial assessment
Access-maturity dimensions
A comparative architecture lens—not a quality score, market ranking, or buying recommendation. Scale: 1–5.
Data access4
Action access4
Event access4
Identity4
Governance4
Agent access2
UI extensibility3
Portability4
Observability3
Documentation5
Proposed customer-shaped experiences
What customers could create on top.
The output could be an export, report, graph, artifact, application, agent, workflow, or downstream feed. These proposals are derived from documented access—not claims that Adobe ships them.
Single-platform patterns
- Commerce implementation and merchandising workbench
- Revenue reconciliation console
- Commerce operations cockpit
- Customer-resolution workbench
Multi-platform compositions
- Adobe Commerce + CRM or support system: revenue reconciliation console
- Adobe Commerce + lifecycle platform + analytics or finance system: cross-system decision workspace
Evidence and dates
First-party references, with publisher and review dates separated
“Publisher updated” is shown only when the page exposes an update date. “BYO-UI reviewed” records when this research checked the reference. A missing publisher date is reported as missing—not replaced with the review date.
8 recorded sources
Platform core validationRepresentative source
https://developer.adobe.com/commerce/webapi/get-started/ ↗Products, categories, prices, inventory, customers, carts and quotes, orders, invoices, shipments, refunds, coupons, stores, and extension configuration. Create and update supported catalog, customer, cart, order,…
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 10, 2026
Targeted first-party core-access review
APISource inventory
https://developer.adobe.com/commerce/webapi/rest/ ↗PaaS and SaaS REST availability, authentication, URL structure, tenant scope, and store scope
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 22, 2026
PaaS/SaaS REST split and authentication reviewed 2026-07-22
Developer docsSource inventory
https://developer.adobe.com/commerce/ ↗First-party developer documentation or platform overview.
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 10, 2026
Inventory source: structurally normalized; content was not individually reopened in this pass.
Developer docsSource inventory
https://developer.adobe.com/commerce/webapi/graphql/ ↗Reverified the named access facet exactly as bounded by the reviewed first-party record.
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 12, 2026
Full-profile first-party re-verification on 2026-07-12; see the private audit ledger.
HomepageSource inventory
https://business.adobe.com/products/magento/magento-commerce.html ↗First-party product homepage used to confirm product identity and current positioning.
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 10, 2026
Inventory source: structurally normalized; content was not individually reopened in this pass.
MCP / agent-role validationSource inventory
https://developer.adobe.com/commerce/extensibility/developer-agent/ ↗App Builder MCP, drop-ins MCP, IDE deployment, and developer-context role
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 22, 2026
Developer MCP role and non-operational boundary reviewed 2026-07-22
Webhooks / extensionsSource inventory
https://developer.adobe.com/commerce/extensibility/webhooks/ ↗First-party webhook, event, SDK, embedded-app, or extension documentation.
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 10, 2026
Inventory source: structurally normalized; content was not individually reopened in this pass.
Authentication and permissionsSource inventory
https://developer.adobe.com/commerce/webapi/get-started/authentication/ ↗PaaS API authentication, caller types, integration access, webapi.xml resources, and ACL permissions
- Publisher updated
- Not stated by publisher
- BYO-UI reviewed
- Jul 22, 2026
Adobe Commerce PaaS API authentication and ACL model reviewed 2026-07-22
Verified fact
Tied to cited first-party evidence reviewed for this profile.
Source inventory
Official links recorded for deeper research but not necessarily reopened endpoint by endpoint.
Editorial assessment
System role, maturity interpretation, and architectural boundary.
Proposed design
Interface patterns and compositions—not vendor product claims.