> ## Documentation Index > Fetch the complete documentation index at: https://docs.dueflow.co/llms.txt > Use this file to discover all available pages before exploring further. # List a listing's items > > **Requires scope** `store:read` · **Minimum role** viewer Returns the items for sale on a listing with price, inventory, sold count, per-person limit, custom fields and images. `soldCount`: Units reserved at checkout: paid orders (refunded ones included) plus pending checkouts. A Stripe checkout's units return when its session expires; units for a checkout that never reached the provider are cleared after 24 hours, the next time someone checks out on the listing; an abandoned Whop checkout, and a checkout whose payment failed (e.g. a returned bank debit), keep their units. [Scopes and roles](https://docs.dueflow.co/api-reference/scopes) ## OpenAPI ````yaml /openapi.json get /v1/store/listings/{listingId}/items openapi: 3.1.0 info: title: Dueflow API version: 1.0.0 description: >- Read and write your organization's Dueflow data. Authenticate with a personal access token or an organization service token as a bearer credential; cookies are ignored. Every endpoint is also a tool on the Dueflow MCP server at https://api.dueflow.co/mcp, which accepts the same bearer tokens or an OAuth connection from ChatGPT and Claude. Timestamps in responses are RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). Timestamps you send are RFC 3339: send UTC (`Z`); some filters, such as `updatedSince`, also accept an offset. Responses may gain fields at any time; ignore the ones you don't know. Every failure answers with the `Error` envelope; branch on its `code`. termsOfService: https://dueflow.co/terms contact: name: Dueflow support email: hello@dueflow.co url: https://docs.dueflow.co servers: - url: https://api.dueflow.co description: Production security: - bearerAuth: [] paths: /v1/store/listings/{listingId}/items: get: tags: - Store summary: List a listing's items description: >- > **Requires scope** `store:read` · **Minimum role** viewer Returns the items for sale on a listing with price, inventory, sold count, per-person limit, custom fields and images. `soldCount`: Units reserved at checkout: paid orders (refunded ones included) plus pending checkouts. A Stripe checkout's units return when its session expires; units for a checkout that never reached the provider are cleared after 24 hours, the next time someone checks out on the listing; an abandoned Whop checkout, and a checkout whose payment failed (e.g. a returned bank debit), keep their units. [Scopes and roles](https://docs.dueflow.co/api-reference/scopes) operationId: getStoreListingsByListingIdItems parameters: - name: listingId in: path required: true schema: type: string responses: '200': description: Success headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: type: object properties: data: type: array items: $ref: '#/components/schemas/StoreItem' required: - data '400': $ref: '#/components/responses/BadRequest' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' '429': $ref: '#/components/responses/RateLimited' default: $ref: '#/components/responses/UnexpectedError' security: - bearerAuth: - store:read components: headers: X-Request-Id: description: >- Identifies the request; quote it to support. Also in the error body as `requestId`. schema: type: string RateLimit-Limit: description: Requests the token's budget for this kind of request allows per window. schema: type: integer RateLimit-Remaining: description: Requests left in the current window. schema: type: integer RateLimit-Reset: description: Seconds until the window resets. schema: type: integer Retry-After: description: Seconds to wait before retrying. schema: type: integer schemas: StoreItem: type: object properties: id: type: string listingId: type: string name: type: string description: type: - string - 'null' price: description: Unit price as a decimal string type: string maxPerPerson: type: - integer - 'null' minimum: -9007199254740991 maximum: 9007199254740991 totalInventory: type: - integer - 'null' minimum: -9007199254740991 maximum: 9007199254740991 soldCount: description: >- Units reserved at checkout: paid orders (refunded ones included) plus pending checkouts. A Stripe checkout's units return when its session expires; units for a checkout that never reached the provider are cleared after 24 hours, the next time someone checks out on the listing; an abandoned Whop checkout, and a checkout whose payment failed (e.g. a returned bank debit), keep their units. type: integer minimum: -9007199254740991 maximum: 9007199254740991 customFields: type: array items: type: object properties: key: type: string label: type: string type: type: string enum: - text - number - phone - date - select placeholder: type: string required: type: boolean options: type: array items: type: object properties: label: type: string value: type: string stock: type: integer minimum: -9007199254740991 maximum: 9007199254740991 required: - label - value required: - key - label - type imageUrls: type: array items: type: string primaryImageUrl: type: - string - 'null' sortOrder: type: integer minimum: -9007199254740991 maximum: 9007199254740991 createdAt: type: string format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). updatedAt: type: string format: date-time description: >- Timestamp: RFC 3339, UTC, millisecond precision (`2026-01-31T17:04:05.123Z`). required: - id - listingId - name - description - price - maxPerPerson - totalInventory - soldCount - customFields - imageUrls - primaryImageUrl - sortOrder - createdAt - updatedAt Error: type: object properties: error: type: object properties: code: description: >- A stable, machine-readable reason. One of `invalid_request` (400), `invalid_token` (401), `insufficient_scope` (403), `step_up_required` (403), `not_found` (404), `method_not_allowed` (405), `conflict` (409), `sync_expired` (410), `rate_limited` (429), `internal_error` (500), `provider_error` (502). New codes may be added; treat an unknown one by its HTTP status. type: string message: type: string param: type: string requiredScopes: type: array items: type: string requestId: type: string docsUrl: type: string required: - code - message - requestId - docsUrl required: - error responses: BadRequest: description: >- Invalid input: a parameter or body field fails validation (`param` names it), the body isn't JSON, or a business rule refused the request. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' Unauthorized: description: Missing, malformed, expired or revoked token. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' Forbidden: description: The token lacks a required scope. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' NotFound: description: No such resource, or the token's organization can't see it. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' RateLimited: description: Rate limited; see the `Retry-After` header. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' Retry-After: $ref: '#/components/headers/Retry-After' content: application/json: schema: $ref: '#/components/schemas/Error' UnexpectedError: description: >- Any other failure, such as `internal_error` (500), as the `Error` envelope. A failure in front of the API (a gateway timeout, a request too large) may instead be plain text. headers: X-Request-Id: $ref: '#/components/headers/X-Request-Id' RateLimit-Limit: $ref: '#/components/headers/RateLimit-Limit' RateLimit-Remaining: $ref: '#/components/headers/RateLimit-Remaining' RateLimit-Reset: $ref: '#/components/headers/RateLimit-Reset' content: application/json: schema: $ref: '#/components/schemas/Error' text/plain: schema: type: string securitySchemes: bearerAuth: type: http scheme: bearer description: >- A Dueflow access token: `dfp_` (personal) or `dfs_` (service). Permissions are the token's scopes intersected with the role ceiling, re-evaluated per request. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.