DocsDocsReference

Auth API contract

Complete HTTP contract for identity, sessions, carts, orders, wishlists, and account routes.

Updated
Apr 26, 2026

Use this contract when you need exact endpoint paths, methods, parameters, request bodies, responses, schemas, and status codes.

Use the operation pages for implementation guidance and this contract file for exact HTTP details.

Operation identity

When an operation page says the OpenAPI contract does not document an Operation ID, cite the stable operation key instead. Stable operation keys use the API, HTTP method, and path, so they identify an endpoint without pretending the contract publishes an operationId.

Registered routes

Use this API-first route list when you already know the owning API and need to find the exact operation page. Routes are grouped by resource so Management, Shopper, Auth, DAM, and Integrations operations stay distinct.

Attributes

Auth

Cart

Customer Groups

Files

Orders

Organisations

Users

Wishlist

Auth API contract

# Auth API contract Use this contract when you need exact endpoint paths, methods, parameters, request bodies, responses, schemas, and status codes. - Public contract file: /swagger/auth-api.json Use the operation pages for implementation guidance and this contract file for exact HTTP details. ## Operation identity When an operation page says the OpenAPI contract does not document an Operation ID, cite the stable operation key instead. Stable operation keys use the API, HTTP method, and path, so they identify an endpoint without pretending the contract publishes an operationId. ## Registered routes Use this API-first route list when you already know the owning API and need to find the exact operation page. Routes are grouped by resource so Management, Shopper, Auth, DAM, and Integrations operations stay distinct. ### Attributes - GET /api/v1/{app_id}/attributes - [List attributes for an application](/reference/attributes/list-attributes-for-an-application) - GET /api/v1/{app_id}/attributes/{attribute_id} - [Get a single attribute](/reference/attributes/get-a-single-attribute) - POST /api/v1/{app_id}/organisations/{organisation_id}/attributes/{attribute_id} - [Add attribute relationship to an organisation](/reference/attributes/add-attribute-relationship-to-an-organisation) - DELETE /api/v1/{app_id}/organisations/{organisation_id}/attributes/{attribute_id} - [Remove attribute relationship from an organisation](/reference/attributes/remove-attribute-relationship-from-an-organisation) - POST /api/v1/{app_id}/users/{user_id}/attributes/{attribute_id} - [Add attribute relationship to a user](/reference/attributes/add-attribute-relationship-to-a-user) - DELETE /api/v1/{app_id}/users/{user_id}/attributes/{attribute_id} - [Remove attribute relationship from a user](/reference/attributes/remove-attribute-relationship-from-a-user) ### Auth - POST /api/v1/{app_id}/auth/change-password - [Change password](/reference/auth/change-password) - POST /api/v1/{app_id}/auth/login - [Login user](/reference/auth/login-user) - POST /api/v1/{app_id}/auth/refresh - [Refresh token](/reference/auth/refresh-token) - POST /api/v1/{app_id}/auth/reset-password - [Create password reset link](/reference/auth/create-password-reset-link) - POST /api/v1/{app_id}/auth/signup - [Register new user](/reference/auth/register-new-user) - POST /api/v1/{app_id}/auth/verify-email - [Create email verification link](/reference/auth/create-email-verification-link) - POST /api/v1/{app_id}/auth/verify-email-token - [Verify email](/reference/auth/verify-email) ### Cart - GET /api/v1/{app_id}/carts - [List saved carts for authenticated user](/reference/cart/list-saved-carts-for-authenticated-user) - POST /api/v1/{app_id}/carts - [Save a new cart reference](/reference/cart/save-a-new-cart-reference) - DELETE /api/v1/{app_id}/carts/{id} - [Delete a saved cart](/reference/cart/delete-a-saved-cart) ### Customer Groups - GET /api/v1/{app_id}/customer-groups/{customer_group_slug} - [Get customer group by slug](/reference/customer-groups/get-customer-group-by-slug) - GET /api/v1/{app_id}/customer-groups/store-groups/{store_group_id}/markets/{market_id}/prices - [Get customer groups with paginated prices for a user or organisation](/reference/customer-groups/get-customer-groups-with-paginated-prices-for-a-user-or-organisation) ### Files - DELETE /api/v1/{app_id}/files/{file_id} - [Delete a file](/reference/files/delete-a-file) - PATCH /api/v1/{app_id}/files/{file_id} - [Patch file metadata](/reference/files/patch-file-metadata) - POST /api/v1/{app_id}/files/upload - [Upload a file](/reference/files/upload-a-file) ### Orders - GET /api/v1/{app_id}/lookup/orders - [List all orders for an app](/reference/orders/list-all-orders-for-an-app) - GET /api/v1/{app_id}/lookup/orders/{id} - [Get order by ID for an app](/reference/orders/get-order-by-id-for-an-app) - GET /api/v1/{app_id}/lookup/orders/reference/{reference} - [Get order by reference for an app](/reference/orders/get-order-by-reference-for-an-app) - GET /api/v1/{app_id}/orders - [List orders for authenticated user](/reference/orders/list-orders-for-authenticated-user) - GET /api/v1/{app_id}/orders/{id} - [Get order by ID for authenticated user](/reference/orders/get-order-by-id-for-authenticated-user) - GET /api/v1/{app_id}/orders/reference/{reference} - [Get order by reference for authenticated user](/reference/orders/get-order-by-reference-for-authenticated-user) ### Organisations - GET /api/v1/{app_id}/lookup/organisations/{organisation-number} - [Get organisation by organisation number](/reference/organisations/get-organisation-by-organisation-number) - GET /api/v1/{app_id}/organisations - [List organisations](/reference/organisations/list-organisations) - POST /api/v1/{app_id}/organisations - [Register new organisation](/reference/organisations/register-new-organisation) - GET /api/v1/{app_id}/organisations/{id} - [Get organisation](/reference/organisations/get-organisation) - DELETE /api/v1/{app_id}/organisations/{id} - [Delete organisation](/reference/organisations/delete-organisation) - PATCH /api/v1/{app_id}/organisations/{id} - [Patch organisation](/reference/organisations/patch-organisation) - GET /api/v1/{app_id}/organisations/{id}/tree - [Get organisation tree](/reference/organisations/get-organisation-tree) - GET /api/v1/{app_id}/organisations/{id}/users - [List users for an organisation](/reference/organisations/list-users-for-an-organisation) - POST /api/v1/{app_id}/organisations/{id}/users - [Add user to organisation](/reference/organisations/add-user-to-organisation) - DELETE /api/v1/{app_id}/organisations/{id}/users/{user_id} - [Remove user from organisation](/reference/organisations/remove-user-from-organisation) ### Users - POST /api/v1/{app_id}/lookup/user - [Lookup user by email](/reference/users/lookup-user-by-email) - GET /api/v1/{app_id}/user - [Gets the user from the token](/reference/users/gets-the-user-from-the-token) - DELETE /api/v1/{app_id}/user - [Delete current user](/reference/users/delete-current-user) - PATCH /api/v1/{app_id}/user - [Updates the user information](/reference/users/updates-the-user-information) - GET /api/v1/{app_id}/users/{user_id} - [Get user by ID](/reference/users/get-user-by-id) - PATCH /api/v1/{app_id}/users/{user_id} - [Update user by ID](/reference/users/update-user-by-id) ### Wishlist - GET /api/v1/{app_id}/shared/wishlists/{token} - [Get shared wishlist (paginated)](/reference/wishlist/get-shared-wishlist-paginated) - GET /api/v1/{app_id}/wishlists - [List wishlists for authenticated user](/reference/wishlist/list-wishlists-for-authenticated-user) - POST /api/v1/{app_id}/wishlists - [Create a new wishlist](/reference/wishlist/create-a-new-wishlist) - GET /api/v1/{app_id}/wishlists/{id} - [Get a particular wishlist with items.](/reference/wishlist/get-a-particular-wishlist-with-items) - DELETE /api/v1/{app_id}/wishlists/{id} - [Delete wishlist](/reference/wishlist/delete-wishlist) - PATCH /api/v1/{app_id}/wishlists/{id} - [Update wishlist](/reference/wishlist/update-wishlist) - POST /api/v1/{app_id}/wishlists/{id}/items - [Add items to wishlist](/reference/wishlist/add-items-to-wishlist) - DELETE /api/v1/{app_id}/wishlists/{id}/items - [Remove items from wishlist](/reference/wishlist/remove-items-from-wishlist) - POST /api/v1/{app_id}/wishlists/{id}/share - [Create or get share token for wishlist](/reference/wishlist/create-or-get-share-token-for-wishlist) - DELETE /api/v1/{app_id}/wishlists/{id}/share/{token} - [Revoke wishlist share token](/reference/wishlist/revoke-wishlist-share-token)