> ## Documentation Index
> Fetch the complete documentation index at: https://api.vitarelay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Display-only catalog access

> Pull the VitaRelay product catalog to display on your own site — without the ability to sell, order, or refer.

Some integrations only need to **show** VitaRelay's products — a browsable catalog on your own website — without placing orders, referring patients, or writing any data. You can do this with a **read-only API key**.

<Info>
  A read-only key can pull the catalog but **cannot sell, order, push, or refer**. Every ordering and referral endpoint requires a `:write` scope; a display-only key simply doesn't carry one, so those actions are blocked at the API.
</Info>

## How it works

Ask your VitaRelay admin for an API key scoped to **read only** — typically:

* `products:read` — the RUO catalog (`GET /catalog`) and product lookups
* `rx:read` — the 503A catalog (`GET /rx/catalog`), if you want to display 503A products

That key can call the catalog endpoints below and nothing else that changes state.

## What you can pull

| Catalog            | Endpoint                                   | Scope           | Products                                 |
| ------------------ | ------------------------------------------ | --------------- | ---------------------------------------- |
| RUO                | `GET /catalog` · `GET /catalog/{id}`       | `products:read` | Research-use-only products               |
| 503A               | `GET /rx/catalog` · `GET /rx/catalog/{id}` | `rx:read`       | 503A compounded products                 |
| 503B (+ all types) | `GET /catalog?type=503b` (Practice API)    | `products:read` | 503B, 503A, and R\&D, filtered by `type` |

<Note>
  Catalog responses never include price, cost, pharmacy identity, or margin — only the displayable product fields (name, category, description, images, dosage form, etc.). They're safe to render publicly.
</Note>

## What a read-only key **cannot** do

* Place or modify orders (needs `orders:write`)
* Add patients or send intakes (needs `patients:write` / `intakes:write`)
* Refer patients to the IDN or push scripts (needs `rx:write`)

If an integration later needs to sell or refer, your admin can issue a separate key with the appropriate write scopes — keep the display key read-only.

## Example

```bash theme={null}
curl https://vitarelay.com/api/public/v1/catalog \
  -H "Authorization: Bearer vr_live_your_readonly_key"
```

Returns a page of RUO products you can render directly on your site.