Merge

POST /api/cloudstore/merge.php

Requires Authorization: AppID:AppKey + user token

Request body

Field	Type	Required	Description
token	string	required	User session token
cloudkey	string	required	Key to modify
ops	array	required	1 to 25 operations, applied in order, on the server
create_if_missing	bool	optional	Default `true`; set `false` to get `404` instead of auto-creating an empty object
owner_userid	int	optional	ID of another user who authorized your email via share.php. If omitted, operates on the token owner's own CloudStore

Operations (`ops`)

Each item is an object with an op and a path. path uses dot notation to reach nested keys — e.g. "items.item_42.qty".

op	Extra fields	Effect
`set`	`value`	Sets the value at `path`, replacing (or creating) it
`increment`	`delta`	Adds `delta` to the current number at `path`. Treated as `0` if it doesn't exist yet
`append`	`value`	Pushes `value` onto the array at `path`. Creates a new array if it doesn't exist
`remove`	—	Removes the key at `path`

Test this endpoint

Headers

Authorization *

Body

token *

cloudkey *

ops *

owner_userid

Example

POST /api/cloudstore/merge.php
Authorization: com.myapp:MyAppKey12345678901234
Content-Type: application/json

{
  "token": "USER_TOKEN",
  "cloudkey": "item-42",
  "ops": [
    { "op": "increment", "path": "qty", "delta": -1 },
    { "op": "set", "path": "last_moved_at", "value": "2026-08-07" }
  ]
}

Success response 200

{
  "success": true,
  "message": "Cloud data merged successfully.",
  "cloudkey": "item-42",
  "dataobject": { "qty": 6, "last_moved_at": "2026-08-07" }
}

The response already returns the resulting dataobject — no need to call get.php afterward to see the new value.

How it stays safe under concurrency

The read, operation, and write happen atomically on the server against the most recent value of that cloudkey — never against a copy the client might have in memory. Two merge.php calls for the same cloudkey arriving at the same time are processed one after the other, never overwriting each other's result. Concurrent merge.php and set.php calls on the same key are also serialized against each other — but remember that set.php, when its turn comes, still replaces the entire object.

Errors