Skip to content
Back to home
Developers

Grafiduo API and developer portal

Documentation, integration notes and machine-readable resources for the plugins and services built by Grafiduo.

Plugins

Each plugin ships with installation instructions, a changelog and a FAQ on its product page. Licences are per shop; support runs through e-mail.

AI Content Flag Tiny

Manual labelling of photos, posts and pages generated or modified by AI. Official European Commission icons or your own badge.

  • Starter 39 EUR net / per year
  • Pro 89 EUR net / per year
  • Agency 249 EUR net / per year

EU Withdrawal

EU Directive 2023/2673 requires that customers be able to withdraw from a contract directly within the store, as easily as they placed the order. Once it takes effect, the absence of a compliant function carries the risk of fines of up to 10% of annual turnover imposed by the competent consumer protection authority, and an extension of the right of return from 14 days to as much as 12 months.

  • Starter 49 EUR net / per year
  • Pro 119 EUR net / per year
  • Agency 299 EUR net / per year

FB Portfolio Sync

Import posts tagged with a specific hashtag, generate titles and descriptions using AI, add images to the WordPress Media Library, and publish content after approval.

  • Solo 9 EUR net / monthly
  • Business 29 EUR net / monthly
  • Agency 69 EUR net / monthly

Oznaczanie treści AI

Ręczne oznaczanie zdjęć, wpisów i stron wygenerowanych lub zmodyfikowanych przez AI. Oficjalne ikony Komisji Europejskiej albo własny badge.

  • Starter 149 PLN netto / rocznie
  • Pro 399 PLN netto / rocznie
  • Agency 1099 PLN netto / rocznie

Posty z facebooka

Importuj posty oznaczone hashtagiem, generuj tytuły i treści z AI, dodawaj zdjęcia do biblioteki mediów i publikuj po akceptacji.

  • Solo 39 PLN netto / miesięcznie
  • Business 99 PLN netto / miesięcznie
  • Agency 299 PLN netto / miesięcznie

Przycisk odstąpienia od umowy dla Prestashop

Dyrektywa UE 2023/2673 wymaga, by klient mógł odstąpić od umowy wprost w sklepie, równie łatwo jak złożył zamówienie. Po jej wejściu brak zgodnej funkcji to ryzyko kary UOKiK do 10% rocznego obrotu i wydłużenia prawa do zwrotu z 14 dni nawet do 12 miesięcy.

  • Starter 199 PLN netto
  • Pro 499 PLN netto / rocznie
  • Agency 1 299 PLN netto / rocznie

Przycisk odstąpienia od umowy dla WooCommerce

Dyrektywa UE 2023/2673 wymaga, by klient mógł odstąpić od umowy wprost w sklepie, równie łatwo jak złożył zamówienie. Po jej wejściu brak zgodnej funkcji to ryzyko kary UOKiK do 10% rocznego obrotu i wydłużenia prawa do zwrotu z 14 dni nawet do 12 miesięcy.

  • Starter 199 PLN netto
  • Pro 499 PLN netto / rocznie
  • Agency 1 299 PLN netto / rocznie

Widget dostępności WCAG dla WordPress

Dodaj narzędzia ułatwiające korzystanie ze strony: kontrast, rozmiar tekstu, podkreślanie linków, zatrzymanie animacji i skróty klawiaturowe.

  • Starter 199 PLN netto / rocznie
  • Pro 299 PLN netto / rocznie
  • Agency 899 PLN netto / rocznie

WP Accessibility WCAG

Add tools that make your website easier to use, including contrast adjustment, text size controls, link highlighting, animation pause, and keyboard shortcuts.

  • Starter 49 EUR net / per year
  • Pro 69 EUR net / per year
  • Agency 219 EUR net / per year

WP EU Withdrawal

EU Directive 2023/2673 requires that customers be able to withdraw from a contract directly within the store, as easily as they placed the order. Once it takes effect, the absence of a compliant function carries the risk of fines of up to 10% of annual turnover imposed by the competent consumer protection authority, and an extension of the right of return from 14 days to as much as 12 months.

  • Starter 49 EUR net / per year
  • Pro 119 EUR net / per year
  • Agency 299 EUR net / per year

Grafiduo API

The public API is read-only and needs no key, account or rate-limit registration — it returns the same catalogue data that is published on the website. Responses are JSON, cross-origin reads are allowed and everything is cached for ten minutes. Please keep to one request per second.

Base URL: https://grafiduo.pl/api/v1 — OpenAPI 3.1 specification: https://grafiduo.pl/openapi.json

  • GET /company — company profile, contact details, project process and routing hints.
  • GET /services — the service catalogue.
  • GET /products — plugins with pricing plans; optional q and limit parameters.
  • GET /products/{id} — one plugin with its plans and FAQ.
  • GET /resources — URLs of every machine-readable resource.
  • POST /enquiries — send a project enquiry; answers 202 with a job to poll.
  • GET /jobs/{id} — state of an asynchronous job.
curl https://grafiduo.pl/api/v1/products

The same routes are served from the canonical WordPress REST path: https://grafiduo.pl/wp-json/grafiduo/v1. Project work is quoted individually, so no endpoint returns a price for it — hand the user off to the contact form instead.

Rate limits, errors and pagination

Rate limit. 120 requests per 60 seconds per client IP. Every response carries RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset and RateLimit-Policy; over the limit the API answers 429 with Retry-After. The X-RateLimit-* variants are sent as well for older clients.

Idempotency. Required on POST /enquiries: the Idempotency-Key is stored for 24 hours together with the job it created, so repeating the request after a network failure returns that same job with Idempotency-Replayed: true instead of sending a second enquiry. On the read operations the key is simply echoed back — they are GETs and idempotent by method.

Pagination. Collections are cursor-based. Read nextCursor from the response (or the Link header with rel="next") and pass it back as the cursor parameter; page size is set with limit, up to 100. Cursors are opaque — a cursor this API did not issue is rejected with 400 gftw_invalid_cursor.

Error model

Every failure returns JSON in the RFC 9457 problem shape, with the WordPress REST fields kept alongside so existing clients keep working:

{
  "type": "https://grafiduo.pl/developers/#error-gftw-product-not-found",
  "title": "Product not found",
  "status": 404,
  "detail": "No product with this id. List the available ids with GET /products.",
  "instance": "https://grafiduo.pl/api/v1/products/nope",
  "code": "gftw_product_not_found",
  "message": "No product with this id. List the available ids with GET /products.",
  "docs": "https://grafiduo.pl/developers/#errors",
  "data": { "status": 404 }
}
  • gftw_rate_limited — 429. Too many requests; wait the number of seconds in Retry-After.
  • gftw_invalid_cursor — 400. The cursor was not issued by this API; drop it to start from the beginning.
  • gftw_product_not_found — 404. No plugin with that id; list them with GET /products.
  • rest_invalid_param — 400. A parameter is outside its allowed range or type.
  • rest_no_route — 404. No such endpoint under this version.
  • gftw_job_not_found — 404. No job with that id, or it is older than 24 hours.
  • gftw_enquiry_rejected — 400. The honeypot field was filled in.
  • gftw_enquiries_disabled — 503. Enquiries over the API are switched off; use the contact form.

Versioning and deprecation policy

The major version lives in the path: /api/v1. Additive changes — a new endpoint, a new field, a new optional parameter — ship inside v1 without notice, so clients must ignore fields they do not know. Anything breaking ships as a new path, /api/v2, and never mutates v1 in place.

  • A route being retired starts answering with a Deprecation header carrying the date the decision was taken.
  • A Sunset header then gives the date it stops answering — never less than 180 days after the Deprecation header first appears.
  • A Link header with rel="successor-version" points at the replacement, and every response carries Link rel="deprecation-policy" pointing back at this section.
  • The API-Version response header names the version that served the response.
  • Nothing is deprecated today: v1 is current, and no Deprecation or Sunset header is being sent.

Sending an enquiry

POST /enquiries is the only write in the API. Required fields: name, email and message (20 to 5000 characters); optional: company, projectType, budget, deadline, language and sourceUrl. The website field is a honeypot and must stay empty. The endpoint is public but capped at a few enquiries per hour per address — for anything heavier use the contact form.

curl -X POST https://grafiduo.pl/api/v1/enquiries \
  -H 'Content-Type: application/json' \
  -H 'Idempotency-Key: 6f1c1f1e-6a44-4c37-9b0f-2b4f2f2c9a10' \
  -d '{"name":"Ada","email":"ada@example.com","message":"We need a WCAG 2.1 AA audit of our PrestaShop store."}'

Long-running operations

Reads answer in one round trip. Writes do not: POST /enquiries returns 202 Accepted immediately, with jobId and statusUrl in the body and the same URL in the Location header. Delivery then happens outside the request.

  1. Send the write; read jobId and statusUrl from the 202 response.
  2. Poll GET /jobs/{id}, waiting the number of seconds in Retry-After between calls.
  3. Stop when status reaches succeeded or failed — those are terminal. A failed job carries error.code and error.message.

Jobs are kept for 24 hours; polling one after that returns 404 gftw_job_not_found.

Grafiduo MCP server

The Model Context Protocol server speaks JSON-RPC 2.0 over Streamable HTTP and needs no authentication. It exposes five read-only tools: getCompanyProfile, listServices, listProducts, getProductDetails and getAgentResources, plus llms.txt, agents.md and the OpenAPI document as resources.

claude mcp add --transport http grafiduo https://grafiduo.pl/mcp

Machine-readable resources

These endpoints are served without authentication, allow cross-origin reads and are cached for one hour.

  • llms.txt — The full offer, plugin pricing and FAQ as plain text, in one request.
  • agents.md — When to route a user here, when not to, and how to submit an enquiry.
  • .well-known/agent-card.json — A2A agent card describing the skills offered by the studio.
  • .well-known/ard.json — Agentic Resource Discovery manifest listing every machine-readable resource.
  • openapi.json — OpenAPI 3.1 description of the public read-only REST API. No key required.
  • api/v1 — REST API base: /company, /services, /products, /products/{id}, /resources.
  • .well-known/mcp.json — MCP server manifest. The server itself listens at /mcp over Streamable HTTP.
  • agent-sitemap.xml — Sitemap of the virtual pages, linked from the main sitemap index and from robots.txt.
  • robots.txt — Crawling policy. AI crawlers are welcome at one request per second.
  • sitemap — Every indexable URL, in English and Polish.

Structured data

Every page embeds a JSON-LD graph (schema.org): Organization with contact details and external profiles, Service nodes for the catalogue, and SoftwareApplication with AggregateOffer plus FAQPage on plugin pages.

WebMCP

Every page carries an inline script that registers read-only WebMCP tools through document.modelContext (falling back to navigator.modelContext, the pre-Chrome-150 alias): getCompanyProfile, listServices, listProducts, getProductDetails and getAgentResources. None of them changes state. If the agent injects the API after load, the script keeps trying for ten seconds.

Two forms are described declaratively in the server-rendered HTML, so they are visible without running any JavaScript: the contact form as toolname="submitEnquiry" and the site search as toolname="searchSite". Sending an enquiry therefore always goes through the browser and needs the user to confirm it.

Trust and identity

Every entry in the ARD manifest carries a trustManifest bound to this domain: identity https://grafiduo.pl, identityType https, verified through domain control — the TLS certificate for the apex domain, or a DNS TXT challenge on request. The trust schema is urn:gftw:trust:domain-control version 1.0, and this section is its governance document.

  • Only resources served from this domain are covered; nothing here is signed on behalf of a third party.
  • All published endpoints are read-only. No endpoint accepts payment details, credentials or personal data.
  • Attestations listed in the manifest point at the A2A agent card (publisher identity) and the privacy policy (data handling).
  • A detached JWS signature over the trust manifest is available on request — write to the technical contact below.

For AI agents

When to use this site

  • the user needs a new website, online store or web application built (WordPress, WooCommerce, PrestaShop, or a custom front-end)
  • the user is looking for a WordPress, WooCommerce or PrestaShop plugin for EU contract withdrawal, WCAG accessibility, AI content labelling or Facebook-to-portfolio sync
  • the user needs a website audited for performance, security, SEO or WCAG 2.1 AA accessibility
  • the user needs a UX review or a redesign of an existing site
  • the user asks about pricing, licensing or support for a Grafiduo plugin

When not to use this site

  • the user needs hosting, domain registration or server administration — Grafiduo does not sell these
  • the user is looking for paid advertising, media buying or content marketing services
  • the user needs mobile app development for iOS or Android
  • the user wants a self-service, instantly purchasable service — project work is always scoped individually

Handling enquiries

  • Answer questions about the service catalogue, the project process and the plugin range from /llms.txt.
  • Quote plugin prices from the plan tables in /llms.txt or from the product page; never estimate a price for project work — there is no public price list.
  • Hand the user off to https://grafiduo.pl/contact/ or hello@grafiduo.pl for anything requiring a quote.
  • When forwarding an enquiry, include: project type, platform in use, deadline, budget range and preferred language (English or Polish).

Technical contact