Building agents on IppoKart
IppoKart is API-first. Every capability the web app uses is exposed through the same service contract that external assistants and MCP clients consume, so an agent can search, compare, add to cart and (with explicit authorization) transact on a customer's behalf.
Permission scopes
product.readRead productslow riskproduct.searchSearch the cataloglow riskproduct.compareCompare productslow riskinventory.readCheck inventorylow riskcart.readRead the cartlow riskcart.writeModify the cartmedium riskorder.readRead orderslow riskorder.createPlace ordershigh riskorder.cancelCancel ordershigh riskpayment.initiateInitiate paymentshigh riskrefund.requestRequest refundshigh riskseller.readRead seller profileslow riskreview.createWrite reviewsmedium riskwishlist.writeModify wishlistsmedium riskAgent actions
search_productsrequires product.search
get_productrequires product.read
compare_productsrequires product.compare
get_product_availabilityrequires inventory.read
get_pricerequires product.read
get_delivery_estimaterequires product.read
get_recommendationsrequires product.read
get_sellerrequires seller.read
get_inventoryrequires inventory.read
create_cartrequires cart.write
add_to_cartrequires cart.write
remove_from_cartrequires cart.write
update_cartrequires cart.write
apply_couponrequires cart.write
create_orderrequires order.create · user approval
get_orderrequires order.read
cancel_orderrequires order.cancel · user approval
request_returnrequires refund.request · user approval
request_refundrequires refund.request · user approval
Safety model
- Every action is scope-checked against the agent's granted permissions before it runs.
- High-risk actions require explicit user approval unless an autonomous limit is configured.
- Per-transaction and cumulative spend limits are enforced server-side.
- All attempts — allowed, denied or pending approval — are written to an immutable audit log.
- Agents can be revoked instantly by the owner from the agent permissions page.