Corthex · PrestaShop / Webservice
Read the shop. Keep the write boundary.
A resource name says what the key can reach. An HTTP method says what it can do. Customer identity is a separate check.
Read-only does not mean public.
A PrestaShop Webservice key can read sensitive records even when it cannot change them. The Corthex module creates a limited read-only connection for selected resources. That is a useful write boundary, but it is not a reason to publish the key, expose every resource in a visitor-facing answer or assume that all shoppers may see the same records. Review resource access and customer authorization as different layers.
The current native module grants GET and HEAD for its explicit resource list. GET reads a resource; HEAD is a read-oriented request without a response body. The module does not grant POST, PUT, PATCH or DELETE. A list containing orders or order_slip therefore does not mean the assistant can create an order, issue a refund or modify a purchase. The resource names describe existing records, not promises of supported customer actions.
PrestaShop’s own access documentation recommends selecting only the rights needed and checking shop association in multistore mode. The matrix below records what Corthex’s module currently declares. It is an implementation reference, not a claim that every listed field is returned to chat or that all shop versions and third-party modules have been tested. Compare it with the key in your own back office after installation.
The complete declared resource list
Inspect the permission, not the marketing label.
Every resource below receives the same read methods in the native module. Grouping explains the data class; it does not grant a visitor access. On a narrow screen, scroll the table horizontally to compare all methods.
| Resource | GET | HEAD | POST / PUT / PATCH / DELETE | Purpose / boundary |
|---|---|---|---|---|
| Customer and conversation context | ||||
addresses | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
customer_messages | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
customer_threads | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
customers | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
groups | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
guests | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
messages | ✓ | ✓ | Not granted | Private customer and support records; not public chat knowledge. |
| Order and fulfillment context | ||||
order_carriers | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_cart_rules | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_details | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_histories | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_invoices | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_payments | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_slip | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
order_states | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
orders | ✓ | ✓ | Not granted | Read existing order-related records; no refund or order change. |
| Catalog and cart context | ||||
carts | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
cart_rules | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
categories | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
combinations | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
manufacturers | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
product_feature_values | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
product_features | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
product_option_values | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
product_options | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
products | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
stock_availables | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
suppliers | ✓ | ✓ | Not granted | Read catalog, combinations and available cart context; no cart writes through this key. |
| Shop reference data | ||||
countries | ✓ | ✓ | Not granted | Interpret the shop’s associated reference data. |
currencies | ✓ | ✓ | Not granted | Interpret the shop’s associated reference data. |
languages | ✓ | ✓ | Not granted | Interpret the shop’s associated reference data. |
stores | ✓ | ✓ | Not granted | Interpret the shop’s associated reference data. |
taxes | ✓ | ✓ | Not granted | Interpret the shop’s associated reference data. |
Pair, link, verify
Keep the three setup responsibilities separate.
First pair the assistant and storefront through the Corthex module. This establishes which assistant is used on this shop. Then use Link Webservice to Corthex in the module. The action enables Webservice and creates the scoped read-only key. Finally, verify the connection in Corthex and test the storefront as a signed-in shopper. A working widget, a linked assistant and a working Webservice are related but different observations.
Record the shop, assistant, module version and key identifier without copying the full secret into your report. In multistore environments, verify the shop association explicitly. Use the module’s reported state as one observation and the real test result as another. A saved configuration alone does not prove that hosting, routing or the current customer session allows the intended read.
Assistant pairing
Select the intended workspace and assistant. Confirm the widget belongs to this shop’s setup.
Webservice linking
Use the module action, inspect the created key and compare resources and read methods with the matrix.
Shopper-context test
Verify your own test customer’s context, a guest refusal and separation from another customer’s orders.
What a successful read still does not prove.
Reading a product record does not demonstrate a cart mutation. Reading an order does not demonstrate a refund. Seeing customer context in one signed-in session does not establish isolation for every account. Test each intended behavior and each relevant refusal independently. Keep the visitor’s request, the key’s methods and the application’s supported tools aligned.
If a request needs a write operation that this connection does not support, give the customer a clear route to staff. Do not suggest granting every Webservice permission as a general troubleshooting step. Changing the method scope changes the access model, rather than confirming the original read-only integration. If your business needs a different workflow, design and review it as a separate integration.
- No private key in the browser or public knowledge sources.
- No order changes inferred from a readable order resource.
- No guest email treated as customer authentication.
- No compatibility promise without a test on the actual installation.