A set of instructions for connecting software to Qapla’s public REST API, a service that manages e-commerce shipping, tracking, labels, courier quotes, and pickup points.

Use it to send shipments or orders, create and confirm carrier labels, track parcels, get shipping quotes, find pickup points, verify addresses, and handle webhooks.

It gives an agent the required API background and directs it to the right reference before making calls. This reduces mistakes with authentication, versions, statuses, and endpoint choice.

qapla-api — Cursor rule for Cursor by Qapla/qapla-api-skill

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/Qapla/qapla-api-skill

Made for: Cursor.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/rules/qapla/qapla-api-skill/qapla-api/github.svg)](https://agentmods.dev/rules/qapla/qapla-api-skill/qapla-api)

Your own site

<a href="https://agentmods.dev/rules/qapla/qapla-api-skill/qapla-api"><img src="https://agentmods.dev/badge/rules/qapla/qapla-api-skill/qapla-api/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/rules/qapla/qapla-api-skill/qapla-api"><img src="https://agentmods.dev/badge/rules/qapla/qapla-api-skill/qapla-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 112 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 667 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00112	$0.00667
Opus 5.5	$0.00045	$0.00267
Sonnet 5.5	$0.00022	$0.00133
Haiku 4.5	$0.00011	$0.00067

Measured 1mo ago against content hash 06964da3c6b9, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

qapla-api scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cursor/rules/qapla-api.mdc · 50 lines

What it actually says

Qapla' Public API (v1.3)

This rule covers integrating with the public REST API of Qapla', a SaaS platform for e-commerce logistics (multi-carrier shipping, tracking, label printing, transactional notifications).

To work on a Qapla' task:

Read references/overview.md first — the canonical orientation: core facts (base URL, auth, response envelope, rate limit, sandbox, versions), the domain model, and the "which endpoint do I need?" decision rule.
Then references/conventions.md and references/authentication.md — they apply to every call.
Pick the endpoint from references/endpoints.md (full catalog) or the per-endpoint deep-dives: references/pushshipment.md, pushorder.md, createlabel.md, getquotes.md, getpudos.md, trackingbytimeframe.md (the pull alternative to webhooks), apivirtual.md (virtual courier). For outbound event callbacks (Pillar 2), see references/webhooks.md. To interpret tracking statuses, see references/statuses.md (branch on the canonical id, never the label). For the version policy and the separate v2 generation, see references/versioning.md; to upgrade a legacy integration, see references/migration.md.
Use the sample payloads in references/examples/ and the dependency-free reference client in scripts/qapla_client.py when writing code.
For the v2 API (Bearer/JWT auth, RESTful resources, async jobs), start at references/v2/overview.md and the deep-dives references/v2/{authentication,parcels,sandbox,couriers,stock-release,endpoints}.md. Most integrations still target v1.3; use v2 when you need a resource it exposes (e.g. parcels).

Guardrails: documents the public API only — do not invent endpoints, parameters, or fields. The live docs at https://api.qapla.dev/1.3/ are the source of truth; if anything here drifts, trust them.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 50 lines · 112 tokens per session scan A 06964da3c6b9

Subscribe to this mod's changes

qapla-api is a cursor rule published in the GitHub repository Qapla/qapla-api-skill (3 stars, last pushed 20d ago), licensed MIT. It adds 112 tokens to every session and 667 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Claude Code E-commerce ai-agent carrier claude claude-skill

cursor

You are working on the checkout service. Preserve transaction integrity and auditability.

mrwogu/promptscript · 53 tokens

storage-plugin

Rules for creating storage-provider plug-ins in the Pixuli application. A storage provider is a component that can list, upload, delete, and create links for stored files.

trueLoving/Pixuli · 0 tokens

tray-api

Regras e documentação da API Tray. Aplica quando o desenvolvedor trabalhar com autenticação OAuth, produtos, pedidos, clientes, webhooks, frete, pagamentos ou qualquer outro recurso da plataforma Tray. Inclui convenções obrigatórias de autenticação, formato de payload, rate limit e índice completo de skills com…

tray-tecnologia/tray-api-ai-plugin · 70 tokens

marketplace-all

Composite skill for the marketplace track. Apply when building catalog or SKU synchronization logic for VTEX marketplace seller connectors. Covers the changenotification endpoint, SKU suggestion lifecycle, product data mapping, price and inventory sync, and fulfillment simulation. Use for implementing seller-side…

vtex/skills · 25,584 tokens

payment-payment-ppp-pos

Apply when implementing a VTEX Payment Provider Protocol connector for Point of Sale (POS) payments on VTEX Sales App. Covers Venda Direta Credito and Venda Direta Debito manifest methods, the two-phase Payment App challenge (terminal connector then wait-for-confirmation), null card data on Create Payment…

vtex/skills · 7,970 tokens

marketplace-marketplace-order-hook

Apply when implementing order integration hooks, feeds, or webhook handlers for VTEX marketplace connectors. Covers Feed v3 (pull) vs Hook (push), filter types (FromWorkflow and FromOrders), order status lifecycle, payload validation, and idempotent processing. Use for building order integrations between VTEX…

vtex/skills · 5,539 tokens