WooCommerce and AI Shopping Agents: What the Store Actually Exposes
On this page, 9 sections
I ran one command against WooCommerce’s own store on 2 September 2026. No key, no token, no login.
curl -D - "https://woocommerce.com/wp-json/wc/store/v1/products?per_page=100"
HTTP/2 200
content-type: application/json; charset=UTF-8
x-wp-total: 1717
x-wp-totalpages: 18
link: <https://woocommerce.com/wp-json/wc/store/v1/products?per_page=100&page=2>; rel="next"
cache-control: max-age=601,717 products, 18 pages, 1,798,918 bytes in that one response, 3.1 seconds. Every product came back with price in minor units, stock status, review count, image URLs, category and brand terms, and an add_to_cart object.
That is the whole catalogue of a store run by the company that makes the software, published to anyone who asks, in a format built for machines.
What is already true before any of this
This is the part of the agentic commerce conversation that nobody starts with, because it is boring and already true. Your store already publishes a machine-readable catalogue.
The interesting questions are what exactly is in it, what an agent can and cannot do with it, and which of the things vendors are promising this year are actually built.
I went and read the specifications rather than the announcements. Here is the split.
Surface one: the Store API, and it is on by default
WooCommerce ships two REST APIs. The one people write about is the authenticated wc/v3 API that needs a consumer key. The one that matters for agents is the Store API at wc/store/v1, and its own documentation is blunt about what it is:
This is an unauthenticated API. It does not require API keys or authentication tokens for access.
WooCommerce Store API documentation, developer.woocommerce.com, read 2 September 2026
Why it is on
It exists so the Cart and Checkout blocks can render on the client. It powers the block themes shipped with WooCommerce 11.0.1, which the plugin directory reports at 7,000,000+ active installations as of 2 September 2026.
If you run the block checkout, this endpoint is live on your domain right now.
The read endpoints an agent would care about:
| Endpoint | What it returns |
|---|---|
GET /wp-json/wc/store/v1/products | Paginated catalogue. per_page defaults to 10, maximum 100. |
GET /wc/store/v1/products/:id | One product, including variations and attributes. |
GET /wc/store/v1/products/collection-data | Price range, attribute counts, rating counts for a filtered set. |
GET /wc/store/v1/products/categories | Category terms with counts. |
GET /wc/store/v1/products/brands | Brand terms. |
GET /wc/store/v1/products/reviews | Reviews, with reviewer name and rating. |
The filters are the reason this is more than a dump
The filter parameters are the reason this is more than a dump. From the same documentation page: search, sku, min_price, max_price, on_sale, stock_status, rating, attributes[0][attribute]=pa_color&attributes[0][slug]=red, orderby=price, and related=34.
An agent asked for a red large shirt under forty dollars does not need to parse your theme. It needs one query string.
curl "https://example.com/wp-json/wc/store/v1/products?attributes[0][attribute]=pa_color&attributes[0][slug]=red&max_price=4000&stock_status[]=instock&orderby=price&order=asc"Prices are in minor units
Prices come back as integer strings in the currency’s smallest unit, with currency_minor_unit alongside. 4000 with minor unit 2 is 40.00. Get that wrong in a script and you are off by a hundred.
The field worth pausing on
One field is worth pausing on. Every product object includes low_stock_remaining and stock_availability. If you have set a low stock threshold, your exact remaining quantity is public.
The thing I did not expect: robots.txt says no
WooCommerce’s own robots.txt, fetched the same day, contains two groups for User-agent: *. The second one, written by Yoast, has this line:
# START YOAST BLOCK
User-agent: *
Disallow: /wp-admin/
Disallow: /wp-login.php*
Disallow: /wp-json/
Disallow: /sso?*How the two groups combine
RFC 9309, the robots.txt standard published in September 2022, says that when more than one group matches the same product token, the matching groups’ rules must be combined into one group.
So the merged rule for every crawler on woocommerce.com disallows /wp-json/, which is the prefix of the endpoint I just pulled 1,717 products from.
Why I got the data anyway
I got the data because curl does not read robots.txt. Nothing does unless it chooses to. robots.txt is a request, and the request here is: do not read the catalogue feed that this store publishes for machines.
That is almost certainly not a decision anybody made. It is the default output of an SEO plugin blocking the REST API, applied to a namespace that did not exist when that default was written.
Who else has that line
The same rule is on a large share of WordPress stores, because it ships with the plugin, not with the store.
If you care whether an AI shopping surface can read your catalogue, that one line decides it for every crawler that obeys the file.
Worth checking against how you handle the other WooCommerce URLs bots should not be walking, which I wrote up in the piece on stopping add-to-cart URLs from being crawled.
And robots.txt may not apply anyway
OpenAI publishes three separate agents with three separate jobs. Read the entry for the one that fetches pages during a conversation:
ChatGPT-User is not used for crawling the web in an automatic fashion. Because these actions are initiated by a user, robots.txt rules may not apply.
OpenAI, Overview of OpenAI Crawlers, read 2 September 2026
Three agents, three jobs
So there are two different questions and one file cannot answer both. OAI-SearchBot decides whether your pages can appear in ChatGPT search answers, and OpenAI says blocking it removes you from those answers.
ChatGPT-User is what fetches a page when a person asks about your product right now, and it treats robots.txt as advisory. GPTBot is training only.
My own file, including its bug
My own site allows all of them. Checking it while writing this, I found adityaarsharma.com/robots.txt is emitting the Content-Signal line three times, identically.
It is harmless and it is still a bug in my own file, so I am naming it rather than pretending the audit came back clean.
If you want the mechanism for controlling bots at the edge rather than in a text file, the Cloudflare setup I use to stop email scraping is the same idea applied to a different problem.
Surface two: the JSON-LD WooCommerce already writes
WooCommerce generates Product structured data in core, in includes/class-wc-structured-data.php. I read the file on trunk on 2 September 2026. The Product node it builds contains:
name,url,description,imagesku, and if the SKU is empty it falls back to the numeric post IDgtin, only ifglobal_unique_idis set and passes a validity checkoffersas anOfferwithpriceSpecification,priceValidUntil,availability,urlandselleraggregateRatingandreviewwhen reviews existinProductGroupWithIDwhen a specific variation is being rendered
The absences are the part that matters
Now the absences, because those are the part that matters. There is no brand. No category. No color, size, material or pattern. No shippingDetails.
No hasMerchantReturnPolicy. Google’s merchant listing documentation, last updated 7 July 2026 lists all of those as recommended properties. WooCommerce core emits none of them.
Your SEO plugin may add some. Core does not.
Two details that will bite a machine reader
Two more details from the source that will bite a machine reader. priceValidUntil is computed as gmdate('Y-12-31', time() + YEAR_IN_SECONDS), which is 31 December of next year, invented, not something you set.
And when a product has no SKU, the sku property in your structured data is the WordPress post ID, which is not an identifier any other system knows.
Surface three: agentic commerce, separating the built from the announced
The Agentic Commerce Protocol is real, open source under Apache 2.0, maintained by OpenAI and Stripe. The GitHub repository was created on 29 September 2025 and has 1,525 stars as of 2 September 2026.
The latest released spec version is dated 2026-04-17 and it defines actual OpenAPI documents:
| Spec file | Endpoints |
|---|---|
openapi.agentic_checkout.yaml | POST /checkout_sessions, POST|GET /checkout_sessions/{id}, POST /checkout_sessions/{id}/complete, POST /checkout_sessions/{id}/cancel |
openapi.cart.yaml | POST /carts, GET|PUT /carts/{id}, POST /carts/{id}/cancel |
openapi.feed.yaml | POST /feeds, GET /feeds/{id}, GET|PATCH /feeds/{id}/products |
openapi.delegate_payment.yaml | POST /agentic_commerce/delegate_payment |
Those endpoints live on your server
Read that table again with one thing in mind: those endpoints live on the merchant’s server. ACP is a specification for what you build, not a service you switch on. WooCommerce implements none of it in core.
The honest limits are on the protocol’s own home page, in its own FAQ, which is why I screenshotted it rather than paraphrasing it.
Three sentences from that panel do most of the work:
- On listings: “No, each AI platform will manage their own process for how businesses can participate. If your business wants to participate in ChatGPT, you’ll need to apply.”
- On discovery: “We’re working to create discovery mechanisms for AI platforms to identify businesses that have implemented ACP.”
- On payments: “Stripe is the first compatible PSP with its Shared Payment Token.”
What that means today
A protocol whose maintainers say discovery is still being created is a protocol where implementing it does not make you findable. Today the path to being sold inside ChatGPT is an application form, not a specification.
That is not a criticism of ACP. It is a correction to the marketing built on top of it, which reliably implies that adding a plugin puts your products in front of an agent.
The adoption number nobody quotes
The plugin directory is a cheap reality check, because install counts are published and cannot be spun. Searching wordpress.org for “agentic commerce” on 2 September 2026 returns 58 results. The largest one built specifically for WooCommerce is this:
Two true things on one page
The header says shopping has moved to AI chat. The sidebar on the same page says 50+ active installations. The next two ACP plugins in that search report 20+ each. WooCommerce reports 7,000,000+.
Both halves of that page are true at once. Something is genuinely being built, and approximately nobody has installed it. If a claim about agentic commerce volume does not come with a number you can check, treat it as a projection.
I could not find a published figure for orders placed through ACP against WooCommerce stores, and I am not going to estimate one.
What is worth doing this week
Four checks, all of them fast, none of them requiring you to believe anything about 2027.
- Find out what you are publishing.
curl -s "https://yourstore.com/wp-json/wc/store/v1/products?per_page=1" | python3 -m json.tool. Read every field. Iflow_stock_remainingor a price you thought was members-only is in there, decide that on purpose. - Read your robots.txt for a
/wp-json/disallow. If it is there and you want AI surfaces reading your catalogue, that line is doing the opposite. If you want it there, keep it, but know you chose it. - Check your Product JSON-LD for
brandand a realsku. Paste a product URL into Google’s Rich Results Test. Ifskuis a five digit number that matches your post ID, your SKUs are empty. - Look at your access log for
OAI-SearchBot,ChatGPT-UserandClaudeBot. Whether they are hitting you at all is a fact you can have today, unlike every forecast in this space.
Where this connects
If you are already running agents against your own WordPress install, the setup in running Claude Code against WordPress covers the credential side, and the piece on a scanner that missed cloaked spam is the same lesson in a different key: what a machine is served is not always what you are served.
Two different readers, two different responses, one URL.
If you want the vendor framing from the source rather than from a summary, OpenAI’s own explainer is worth the fifteen minutes.
Buy it in ChatGPT: Instant Checkout and the Agentic Commerce Protocol, on the OpenAI channel. Covers the buyer-side flow and where the merchant sits in it. Verified via the YouTube oEmbed endpoint on 2 September 2026.
For the memory and retrieval side of building agents that act on store data, the comparison of AI memory tools covers what actually persists between runs.
Resources
- WooCommerce Store API documentation, including the unauthenticated statement and the full endpoint table
- Store API products endpoint, every filter parameter
- WooCommerce class-wc-structured-data.php on trunk, the source for what JSON-LD core emits
- Google merchant listing structured data, last updated 7 July 2026
- agenticcommerce.dev and the ACP specification repository
- OpenAI crawler and user agent documentation
- RFC 9309, Robots Exclusion Protocol