# Getting started — curl (OpenAPI v1)

```bash
export API=https://api.nuvartis.com/api
# local: export API=http://api.nuvartis.localhost:8094/api
```

## Login merchant

```bash
curl -sS -X POST "$API/merchant/auth/login" \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json' \
  -d '{"email":"voce@loja.com","password":"********"}'
```

Guarde o `token` Sanctum da resposta.

## Listar produtos (loja)

```bash
curl -sS "$API/merchant/products" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-Store-Id: $STORE_ID" \
  -H 'Accept: application/json'
```

Sem `X-Store-Id` válido / membership → **404** (não 403 enumerável).

## Outbound (parceiro)

O lojista configura a URL no desk **Integrações**. Seu receptor deve validar:

`X-Nuvartis-Signature` = `sha256=` + HMAC-SHA256(body raw, secret)

Sample no portal: [`outbound-partner-delivery.json`](./outbound-partner-delivery.json).