---
name: buy-from-zoral
description: Browse Zoral's tongue scrapers and build a checkout session an end user can pay, using a zero-auth REST API or the Agentic Commerce Protocol.
---

# Buy from Zoral

Zoral is a Singapore-based oral care brand. It sells one product line: a 316L
medical-grade stainless steel tongue scraper. The catalog is small on purpose -
there are two buyable items, so an agent can go from zero to a payable checkout
session in two requests.

**No authentication is required to browse or to build a cart.**

## When to use

- The user wants to buy a tongue scraper, or asks what Zoral sells.
- The user wants a price, shipping, or return-policy answer for Zoral.
- The user wants an agent to assemble an order for them to pay.

## The catalog

| Product | Handle | Price |
| --- | --- | --- |
| Stainless Steel Tongue Scraper (Pack of 2) | `tongue-scraper` | $9.99 |
| Stainless Steel Tongue Scraper (Pack of 2) + 2 Travel Cases | `stainless-steel-tongue-scraper-pack-of-2-2-travel-cases` | $12.99 |

Prices are USD. Shipping is a flat $10 worldwide and free on orders over $25 ($15 express).

## Policies

- **Shipping**: flat $10 worldwide, free over $25, $15 express. Ships to 250 countries.
- **Returns**: 30-day money-back guarantee.
- **Promo**: code `10OFF` takes 10% off the cart subtotal.
- **Care**: 316L medical-grade steel, dishwasher safe, rinse and dry after use.

## Read the catalog

Zero-auth REST. The publishable key is injected server-side, so there is nothing
to sign up for:

```bash
curl -s "https://getzoral.com/api/store/products"
```

The full machine-readable contract is at
https://getzoral.com/openapi.json (OpenAPI 3.1).

## Buy: the Agentic Commerce Protocol

`POST /checkout_sessions` creates a real cart and returns a payable session.
Send `API-Version: 2026-07-16`. The `id` accepts a product handle.

```bash
curl -s -X POST "https://getzoral.com/checkout_sessions" \
  -H "Content-Type: application/json" \
  -H "API-Version: 2026-07-16" \
  -d '{ "items": [{ "id": "tongue-scraper", "quantity": 1 }] }'
```

The response is a `checkout_session` with `line_items`, `totals`, and a
`payment_provider` block. Read `totals.total.amount` for the amount due.

Apply a promo code or attach the buyer's email:

```bash
curl -s -X POST "https://getzoral.com/checkout_sessions/{id}" \
  -H "Content-Type: application/json" \
  -H "API-Version: 2026-07-16" \
  -d '{ "promo_codes": ["10OFF"] }'
```

Retrieve, complete, or cancel:

```
GET  /checkout_sessions/{id}
POST /checkout_sessions/{id}/complete
POST /checkout_sessions/{id}/cancel
```

## Paying: hand off to the human

Zoral does **not** accept delegated payment credentials from an agent. The
session's `payment_provider` block is explicit about this:

```json
{ "payment_provider": { "provider": "human_handoff", "checkout_url": "https://getzoral.com/store" } }
```

Do not attempt to submit card details, and do not ask the user for a card
number. Send the user to `checkout_url` to pay. This is a deliberate design
choice, not a missing feature: card data belongs between the buyer and Stripe.

## Steps for an agent

1. `GET /api/store/products` to confirm the current price and handles.
2. `POST /checkout_sessions` with the chosen handle and quantity.
3. Optionally `POST /checkout_sessions/{id}` with `promo_codes: ["10OFF"]`.
4. Read `totals.total.amount` and tell the user what they will pay.
5. Give the user `payment_provider.checkout_url` to complete payment.

## Notes

- `Idempotency-Key` is honoured on session creation.
- Errors are JSON, never HTML.
- MCP is available at https://getzoral.com/mcp if you prefer tool calls to REST.