Quota Vita Developer & Agent API

Quota Vita is a Catalan sports-nutrition brand (whey protein and creatine, made in Catalonia). This is the Quota Vita developer portal: everything an engineer or an AI agent needs to read the catalog, build a cart and complete a purchase programmatically. Everything on this page is public, free and needs no application form.

Machine-readable index

Resource	URL	Format
OpenAPI 3.1 specification	/openapi.json	application/json
OpenAPI 3.1 (YAML)	/api/openapi.yaml	application/yaml
MCP server manifest	/mcp.json	application/json
Agent instructions (when to use us, how to call us)	/agents.md	text/markdown
Same, alternate URLs	/llms.txt, /llms-full.txt	text/markdown
UCP commerce discovery	/.well-known/ucp	application/json
Sitemap	/sitemap.xml	application/xml
Pricing	/pricing and /products.json	HTML + schema.org/Offer, JSON

Quickstart

No key, no signup. Three calls take you from zero to a priced cart.

# 1. Read the catalog
curl -s https://www.quotavita.com/products.json | jq '.products[] | {title, handle, variants: [.variants[] | {id, title, price}]}'

# 2. Add a variant to a cart (keep the cookie jar - the cart lives in the `cart` cookie)
curl -s -c jar -b jar -X POST https://www.quotavita.com/cart/add.js \
  -H 'Content-Type: application/json' \
  -d '{"id": 10593513963867, "quantity": 1}'

# 3. Read the cart back
curl -s -c jar -b jar https://www.quotavita.com/cart.js

Pass a variant id to /cart/add.js, never a product id. Prices in /products.json are decimal strings in EUR; prices in the UCP MCP responses are integer minor units ({"amount": 3600, "currency": "EUR"} is 36,00 EUR).

Endpoints

Catalog (read-only, unauthenticated)

GET /products.json?limit=250&page=1 - every published product and variant
GET /products/{handle}.json - one product. Unknown handle returns 404 with an empty body - rely on the status code
GET /collections/{handle}/products.json - products in a collection. An unknown handle returns 200 with an empty products array, not a 404, so check the array length
GET /search/suggest.json?q={query}&resources[type]=product - predictive search

Cart

GET /cart.js
POST /cart/add.js - {"id": variantId, "quantity": n}
POST /cart/change.js, POST /cart/update.js

GraphQL

POST /api/2026-07/graphql.json - Shopify Storefront GraphQL API, fully typed and introspectable. Send a Storefront access token in X-Shopify-Storefront-Access-Token.

Commerce over MCP (UCP)

POST /api/ucp/mcp - JSON-RPC 2.0, Streamable HTTP. Call initialize, then tools/list to get every tool and its JSON Schema, then tools/call.
Tools include search_catalog, get_catalog_item, create_cart, update_cart, create_checkout, get_checkout, update_checkout, complete_checkout.

Authentication and scopes

Quota Vita supports four scoped access models. All four are declared formally under components.securitySchemes in /openapi.json. Ask for the narrowest one that does the job.

No auth - the whole catalog, search and cart surface above is open. Start here.
UCP agent profile - the MCP endpoint has no bearer token. Every tools/call carries an agent profile URI at params.arguments.meta['ucp-agent'].profile; Quota Vita fetches that profile and grants only the capabilities it declares, so a catalog-read agent cannot create a checkout. A missing or unfetchable profile is rejected with HTTP 422 and JSON-RPC code -32001 (data.code = "invalid_profile_url").
Storefront API access token - a scoped API key for the GraphQL endpoint, issued per integration against a fixed set of unauthenticated_* scopes and revocable individually. Email hi@quotavita.com with the scopes you need.
Customer Account OAuth 2.0 - authorization code + PKCE, for buyer-specific data (orders, addresses). The buyer grants the scopes explicitly; tokens are bound to one buyer and expire.

Error contract

Every documented endpoint fails with JSON, never an HTML page. If you get Content-Type: text/html from one of these paths, treat it as a routing failure, not an API error: re-read /openapi.json and retry the documented path.

# UCP / MCP - JSON-RPC 2.0
{"jsonrpc":"2.0","id":1,"error":{"code":-32001,"message":"UCP discovery failed",
 "data":{"code":"invalid_profile_url","content":"Unable to fetch agent profile",
         "continue_url":"https://www.quotavita.com/"}}}

# Ajax Cart API
{"status":422,"message":"Cart Error","description":"Cannot find variant"}

# Storefront GraphQL (HTTP 200 even on failure - always inspect `errors`)
{"errors":[{"message":"...","extensions":{"code":"ACCESS_DENIED"}}]}

JSON-RPC codes: -32600 invalid request, -32601 method not found, -32602 invalid params, -32001 UCP identity or discovery failure. data.continue_url is where a human should continue when the agent cannot resolve the failure alone.

Rate limits

The MCP endpoint and the Storefront API are rate limited per IP and per token. Back off on 429 and honour Retry-After when present. There is no paid tier and no quota to buy - be reasonable and cache /products.json.

Sandbox

There is no separate sandbox host. Everything except complete_checkout is side-effect free: catalog reads, search, cart creation and checkout creation can all be exercised against production without placing an order. A cart is scoped to your own cart cookie, so nothing you do is visible to another client. Never call complete_checkout without contemporaneous approval from the human buyer.

CLI

An official Quota Vita CLI (quotavita) wraps the endpoints above so you can script catalog reads, search and cart building without writing an HTTP client. See /mcp.json for the current distribution channel.