# Experience API overview

**Endpoints, sessions, and the operations of the Experience API.**

The Commerce Integration Layer serves one GraphQL API per Project, the **Experience API**. The [router](/commerce-integration-layer/overview.md#router) combines the Core Subgraph with the [extensions](/commerce-integration-layer/overview.md#extensions) you publish and serves them as one schema.

The Experience API is separate from the [HTTP API](/api) and has its own [hosts and authorization](/commerce-integration-layer/hosts-and-authorization.md). Each request carries a shopper [session token](/commerce-integration-layer/experience-api-overview.md#sessions-and-authorization) instead of a commercetools access token.

## Endpoints

### Experience API endpoint

The router serves the Experience API at `/{projectKey}/main/graphql`. Send GraphQL requests with `POST` and an `Authorization: Bearer <session token>` header. For the host, see [Hosts and authorization](/commerce-integration-layer/hosts-and-authorization.md#hosts).

The router validates each query against the published schema of your Project. This schema includes Project-specific types and fields, such as product types with their typed attributes and Custom Fields.

> Introspection isn't available on the public GraphQL endpoint. To explore the schema and run operations, use [`commercetools integration-layer explore`](/commerce-integration-layer/development/get-started.md#explore-your-projects-api) in the CLI. To download the SDL, use [`commercetools integration-layer schema fetch`](/commerce-integration-layer/development/get-started.md#fetch-the-schema).

### Identity endpoints

You create and manage sessions with REST [identity endpoints](/commerce-integration-layer/hosts-and-authorization.md#identity-endpoints). GraphQL operations never create, renew, or rotate a session.

## Sessions and authorization

Every GraphQL request requires a session token. A session represents an anonymous or signed-in shopper and holds the presentment context: locale, currency, and country. Price-dependent and locale-dependent fields read this context.

A session is a stateless JWT that contains a sealed commercetools access token:

- The browser only holds the session token. The commercetools access token stays on the server.
- The Commerce Integration Layer validates the sealed token on every request, so revoking a session takes effect immediately.

> **Warning:** If a query needs presentment and the session has none, the request fails with a `SESSION_MISSING_PRESENTMENT` error. The Commerce Integration Layer doesn't apply a default.

To create a session with presentment, see [Get started](/commerce-integration-layer/development/get-started.md#query-from-your-application).

## Schema entry points

The Core Subgraph groups its operations by area. Each area has a reference page with the arguments, return types, and example requests of its operations. Your Project's schema also contains fields derived from its configuration and from published extensions.

| Area | Queries | Mutations |
| --- | --- | --- |
| [Common types](/commerce-integration-layer/experience/common-types.md) | `viewer`, `node` |  |
| [Catalog](/commerce-integration-layer/experience/catalog.md) | `product`, `products`, `search`, `categories`, `category` |  |
| [Cart](/commerce-integration-layer/experience/cart.md) | `cart`, `shippingMethodsForCart`, `paymentMethods` | `addCartLine`, `addCartLines`, `updateCartLineQuantity`, `updateCartLineCustomFields`, `removeCartLine`, `clearCart`, `applyDiscountCode`, `removeDiscountCode`, `setShippingAddress`, `setBillingAddress`, `setCustomerEmail`, `setPurchaseOrderNumber`, `selectShippingMethod`, `clearShippingMethod`, `beginPayment` |
| [Order](/commerce-integration-layer/experience/order.md) | `orders`, `order` | `checkout`, `guestCheckout`, `placeOrder`, `reorder`, `requestReturn`, `cancelOrder` |
| [Account](/commerce-integration-layer/experience/account.md) | `me` | `register`, `updateProfile`, `setMiddleName`, `setTitle`, `setSalutation`, `setDateOfBirth`, `setCompanyName`, `setVatId`, `changePassword`, `changeEmail`, `addAddress`, `updateAddress`, `removeAddress`, `setDefaultAddress` |
| [Shopping List](/commerce-integration-layer/experience/list.md) | `shoppingLists`, `shoppingList` | `createShoppingList`, `updateShoppingList`, `addShoppingListLine`, `addToShoppingList`, `changeShoppingListLineQuantity`, `removeShoppingListLine`, `deleteShoppingList` |
| [B2B](/commerce-integration-layer/experience/b2b.md): Business Units and Associates | `businessUnits`, `businessUnit`, `activeBusinessUnit` | `createBusinessUnit`, `changeBusinessUnitName`, `setBusinessUnitContactEmail`, `addBusinessUnitAddress`, `updateBusinessUnitAddress`, `removeBusinessUnitAddress`, `addAssociate`, `updateAssociateRoles`, `removeAssociate` |
| [B2B](/commerce-integration-layer/experience/b2b.md): Quotes | `quoteRequests`, `quoteRequest`, `quotes`, `quote` | `requestQuote`, `cancelQuoteRequest`, `acceptQuote`, `declineQuote`, `renegotiateQuote` |
| [B2B](/commerce-integration-layer/experience/b2b.md): Approvals | `approvals`, `approval`, `approvalRules`, `approvalRule` | `approveOrder`, `rejectOrder`, `createApprovalRule`, `updateApprovalRule`, `setApprovalRuleActive` |

To place an Order, use the mutation that matches the checkout:

- `beginPayment`: starts a [Checkout](/commerce-integration-layer/development/checkout-integration.md) flow for a Customer or a guest. Checkout creates the Order.
- `checkout`: places the Order for a signed-in Customer.
- `guestCheckout`: places the Order for a guest.
- `placeOrder`: places a B2B Order as the Associate in the selected Business Unit. The permissions of the Associate and the Approval Rules of the Business Unit apply.

`checkout`, `guestCheckout`, and `placeOrder` place the Order without collecting a payment. To collect a payment with these mutations, use an [extension](/commerce-integration-layer/overview.md#extensions).

> You change the session context, such as presentment, the selected Business Unit, or the Store, with the [identity endpoints](/commerce-integration-layer/hosts-and-authorization.md#identity-endpoints), not with GraphQL mutations. For example, `register` creates a Customer, and you then sign that Customer in with a session grant on the identity endpoint.

## Extensibility model

The Core Subgraph exposes its top-level resources as federation entities. An [extension](/commerce-integration-layer/overview.md#extensions) can add fields to these entities without redeclaring the whole type. For the list of extensible types, see the [entity catalog](/commerce-integration-layer/schema-extensions.md#entity-catalog).

Extensions can also:

- Compute fields from data that the Commerce Integration Layer owns, with `@requires`.
- Return entity stubs that the router resolves to full objects.
- Register [Managed API Extensions](/commerce-integration-layer/managed-api-extensions.md) that run on write operations.

For the SDL and resolver details, see [Write Schema Extensions](/commerce-integration-layer/development/writing-schema-extensions.md).

## Related pages

- [Area overview page with navigation](/commerce-integration-layer.md)
- [Next page: Hosts and authorization](/commerce-integration-layer/hosts-and-authorization.md)
- [Search documentation and API specs](/search.md)