DocsDocsReference

Auth API contract

Complete HTTP contract for identity, sessions, carts, orders, wishlists, and account routes.

Updated
Apr 26, 2026

Use this contract when you need exact endpoint paths, methods, parameters, request bodies, responses, schemas, and status codes.

Use the operation pages for implementation guidance and this contract file for exact HTTP details.

Operation identity

When an operation page says the OpenAPI contract does not document an Operation ID, cite the stable operation key instead. Stable operation keys use the API, HTTP method, and path, so they identify an endpoint without pretending the contract publishes an operationId.

Registered routes

Use this API-first route list when you already know the owning API and need to find the exact operation page. Routes are grouped by resource so Management, Shopper, Auth, DAM, and Integrations operations stay distinct.

Attributes

Auth

Cart

Customer Groups

Files

Orders

Organisations

Users

Wishlist

Auth API contract

# Auth API contract Use this contract when you need exact endpoint paths, methods, parameters, request bodies, responses, schemas, and status codes. - Public contract file: /swagger/auth-api.json Use the operation pages for implementation guidance and this contract file for exact HTTP details. ## Operation identity When an operation page says the OpenAPI contract does not document an Operation ID, cite the stable operation key instead. Stable operation keys use the API, HTTP method, and path, so they identify an endpoint without pretending the contract publishes an operationId. ## Registered routes Use this API-first route list when you already know the owning API and need to find the exact operation page. Routes are grouped by resource so Management, Shopper, Auth, DAM, and Integrations operations stay distinct. ### Attributes - POST /api/v1/{app_id}/users/{user_id}/attributes/{attribute_id} - [Add attribute relationship to a user](/reference/attributes/add-attribute-relationship-to-a-user) - POST /api/v1/{app_id}/organisations/{organisation_id}/attributes/{attribute_id} - [Add attribute relationship to an organisation](/reference/attributes/add-attribute-relationship-to-an-organisation) - GET /api/v1/{app_id}/attributes/{attribute_id} - [Get a single attribute](/reference/attributes/get-a-single-attribute) - GET /api/v1/{app_id}/attributes - [List attributes for an application](/reference/attributes/list-attributes-for-an-application) - DELETE /api/v1/{app_id}/users/{user_id}/attributes/{attribute_id} - [Remove attribute relationship from a user](/reference/attributes/remove-attribute-relationship-from-a-user) - DELETE /api/v1/{app_id}/organisations/{organisation_id}/attributes/{attribute_id} - [Remove attribute relationship from an organisation](/reference/attributes/remove-attribute-relationship-from-an-organisation) ### Auth - POST /api/v1/:app_id/auth/change-password - [Change password](/reference/auth/change-password) - POST /api/v1/:app_id/auth/verify-email - [Create email verification link](/reference/auth/create-email-verification-link) - POST /api/v1/:app_id/auth/reset-password - [Create password reset link](/reference/auth/create-password-reset-link) - POST /api/v1/:app_id/auth/login - [Login user](/reference/auth/login-user) - POST /api/v1/:app_id/auth/refresh - [Refresh token](/reference/auth/refresh-token) - POST /api/v1/:app_id/auth/signup - [Register new user](/reference/auth/register-new-user) - POST /api/v1/:app_id/auth/verify-email-token - [Verify email](/reference/auth/verify-email) ### Cart - DELETE /api/v1/{app_id}/carts/{id} - [Delete a saved cart](/reference/cart/delete-a-saved-cart) - GET /api/v1/{app_id}/carts - [List saved carts for authenticated user](/reference/cart/list-saved-carts-for-authenticated-user) - POST /api/v1/{app_id}/carts - [Save a new cart reference](/reference/cart/save-a-new-cart-reference) ### Customer Groups - GET /api/v1/{app_id}/customer-groups/{customer_group_slug} - [Get customer group by slug](/reference/customer-groups/get-customer-group-by-slug) - GET /api/v1/{app_id}/customer-groups/store-groups/{store_group_id}/markets/{market_id}/prices - [Get customer groups with paginated prices for a user or organisation](/reference/customer-groups/get-customer-groups-with-paginated-prices-for-a-user-or-organisation) ### Files - DELETE /api/v1/{app_id}/files/{file_id} - [Delete a file](/reference/files/delete-a-file) - PATCH /api/v1/{app_id}/files/{file_id} - [Patch file metadata](/reference/files/patch-file-metadata) - POST /api/v1/{app_id}/files/upload - [Upload a file](/reference/files/upload-a-file) ### Orders - GET /api/v1/{app_id}/lookup/orders/{id} - [Get order by ID for an app](/reference/orders/get-order-by-id-for-an-app) - GET /api/v1/{app_id}/orders/{id} - [Get order by ID for authenticated user](/reference/orders/get-order-by-id-for-authenticated-user) - GET /api/v1/{app_id}/lookup/orders/reference/{reference} - [Get order by reference for an app](/reference/orders/get-order-by-reference-for-an-app) - GET /api/v1/{app_id}/orders/reference/{reference} - [Get order by reference for authenticated user](/reference/orders/get-order-by-reference-for-authenticated-user) - GET /api/v1/{app_id}/lookup/orders - [List all orders for an app](/reference/orders/list-all-orders-for-an-app) - GET /api/v1/{app_id}/orders - [List orders for authenticated user](/reference/orders/list-orders-for-authenticated-user) ### Organisations - POST /api/v1/{app_id}/organisations/{id}/users - [Add user to organisation](/reference/organisations/add-user-to-organisation) - DELETE /api/v1/{app_id}/organisations/{id} - [Delete organisation](/reference/organisations/delete-organisation) - GET /api/v1/{app_id}/organisations/{id} - [Get organisation](/reference/organisations/get-organisation) - GET /api/v1/{app_id}/lookup/organisations/{organisation-number} - [Get organisation by organisation number](/reference/organisations/get-organisation-by-organisation-number) - GET /api/v1/{app_id}/organisations/{id}/tree - [Get organisation tree](/reference/organisations/get-organisation-tree) - GET /api/v1/{app_id}/organisations - [List organisations](/reference/organisations/list-organisations) - GET /api/v1/{app_id}/organisations/{id}/users - [List users for an organisation](/reference/organisations/list-users-for-an-organisation) - PATCH /api/v1/{app_id}/organisations/{id} - [Patch organisation](/reference/organisations/patch-organisation) - POST /api/v1/{app_id}/organisations - [Register new organisation](/reference/organisations/register-new-organisation) - DELETE /api/v1/{app_id}/organisations/{id}/users/{user_id} - [Remove user from organisation](/reference/organisations/remove-user-from-organisation) ### Users - DELETE /api/v1/{app_id}/user - [Delete current user](/reference/users/delete-current-user) - GET /api/v1/{app_id}/users/{user_id} - [Get user by ID](/reference/users/get-user-by-id) - GET /api/v1/{app_id}/user - [Gets the user from the token](/reference/users/gets-the-user-from-the-token) - POST /api/v1/{app_id}/lookup/user - [Lookup user by email](/reference/users/lookup-user-by-email) - PATCH /api/v1/{app_id}/users/{user_id} - [Update user by ID](/reference/users/update-user-by-id) - PATCH /api/v1/{app_id}/user - [Updates the user information](/reference/users/updates-the-user-information) ### Wishlist - POST /api/v1/{app_id}/wishlists/{id}/items - [Add items to wishlist](/reference/wishlist/add-items-to-wishlist) - POST /api/v1/{app_id}/wishlists - [Create a new wishlist](/reference/wishlist/create-a-new-wishlist) - POST /api/v1/{app_id}/wishlists/{id}/share - [Create or get share token for wishlist](/reference/wishlist/create-or-get-share-token-for-wishlist) - DELETE /api/v1/{app_id}/wishlists/{id} - [Delete wishlist](/reference/wishlist/delete-wishlist) - GET /api/v1/{app_id}/wishlists/{id} - [Get a particular wishlist with items.](/reference/wishlist/get-a-particular-wishlist-with-items) - GET /api/v1/{app_id}/shared/wishlists/{token} - [Get shared wishlist (paginated)](/reference/wishlist/get-shared-wishlist-paginated) - GET /api/v1/{app_id}/wishlists - [List wishlists for authenticated user](/reference/wishlist/list-wishlists-for-authenticated-user) - DELETE /api/v1/{app_id}/wishlists/{id}/items - [Remove items from wishlist](/reference/wishlist/remove-items-from-wishlist) - DELETE /api/v1/{app_id}/wishlists/{id}/share/{token} - [Revoke wishlist share token](/reference/wishlist/revoke-wishlist-share-token) - PATCH /api/v1/{app_id}/wishlists/{id} - [Update wishlist](/reference/wishlist/update-wishlist)