A vendor belongs to the tenant (no sales channel); its identity is externalId. Without one a POST always creates. onDuplicate (default 'update') decides: 201 created, 200 updated, unchanged or skipped, 409 duplicate. contacts replace the whole set on an update. No event is emitted. Unknown fields are refused (400).

Scope: products:write, channel:write or admin.

Idempotency: send Idempotency-Key; a retry with the same key replays the first answer.

Rate limit: write class, 1,200 requests per minute per tenant by default (read class 6,000). Every response carries X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset; a refusal is 429 rate_limited with Retry-After.