Zum Inhalt springen
Vinosoft2026-04-01
en/de
API-Referenz-Navigation

Customer Credential

Kunde

Customer Credential groups 4 operations on the customer tier.

Customer authentication endpoint — called without a customer token, since this is how one is obtained.

POST

/api/{version}/customer/account/register

Create a shopper account and email a confirmation link. 201 on success; 409 if it exists.

AuthentifizierungAnonymCustomer authentication endpoint — called without a customer token, since this is how one is obtained.

Request-Body

application/json, text/json, application/*+json · optional

RegisterRequest

Body for POST customer/account/register.

  • emailstringnullable
  • passwordstringnullable
  • callback_url_templatestringnullable

Antworten

curl -X POST \
  'https://<your-shop-domain>/api/2026-04-01/customer/account/register' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "string",
  "password": "string",
  "callback_url_template": "string"
}'
Antwort201Beispielstruktur
{
  "registered": true
}
POST

/api/{version}/customer/account/register/confirm

Confirm an email with the token from the registration link. 200 on success; 400 otherwise.

AuthentifizierungAnonymCustomer authentication endpoint — called without a customer token, since this is how one is obtained.

Request-Body

application/json, text/json, application/*+json · optional

ConfirmEmailRequest

Body for POST customer/account/register/confirm.

  • emailstringnullable
  • tokenstringnullable

Antworten

curl -X POST \
  'https://<your-shop-domain>/api/2026-04-01/customer/account/register/confirm' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "string",
  "token": "string"
}'
Antwort200Beispielstruktur
{
  "confirmed": true
}
POST

/api/{version}/customer/account/resetpassword/init

Start a password reset (email a reset link). Always 202 on a valid request — no enumeration oracle.

AuthentifizierungAnonymCustomer authentication endpoint — called without a customer token, since this is how one is obtained.

Request-Body

application/json, text/json, application/*+json · optional

ForgotPasswordRequest

Body for POST customer/account/resetpassword/init.

  • emailstringnullable
  • callback_url_templatestringnullable

Antworten

curl -X POST \
  'https://<your-shop-domain>/api/2026-04-01/customer/account/resetpassword/init' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "string",
  "callback_url_template": "string"
}'
Antwort202Beispielstruktur
{
  "accepted": true
}
POST

/api/{version}/customer/account/resetpassword/finish

Finish a password reset with the emailed token. 200 on success; 400/422 otherwise.

AuthentifizierungAnonymCustomer authentication endpoint — called without a customer token, since this is how one is obtained.

Request-Body

application/json, text/json, application/*+json · optional

ResetPasswordRequest

Body for POST customer/account/resetpassword/finish.

  • emailstringnullable
  • tokenstringnullable
  • passwordstringnullable

Antworten

curl -X POST \
  'https://<your-shop-domain>/api/2026-04-01/customer/account/resetpassword/finish' \
  -H 'Accept: application/json' \
  -H 'Content-Type: application/json' \
  -d '{
  "email": "string",
  "token": "string",
  "password": "string"
}'
Antwort200Beispielstruktur
{
  "reset": true
}

Schemas

ApiErrorResponse

The error envelope every non-2xx response from this API uses. Documentation shape: actions build it as an anonymous object, so this type exists to give the OpenAPI document a schema to point at.

  • errorsstringnullable

    Human-readable description of what went wrong, e.g. Not Found, Invalid page_info.

  • codestringnullable

    Machine-readable error code. Only a few endpoints (checkout) emit one; omitted everywhere else.

ConfirmEmailRequest

Body for POST customer/account/register/confirm.

  • emailstringnullable
  • tokenstringnullable

CustomerEmailConfirmedResponse

Envelope returned by POST customer/account/register/confirm with 200. An invalid, expired or already-used token is a 400.

  • confirmedboolean

    Always true on a 200.

CustomerPasswordResetRequestedResponse

Envelope returned by POST customer/account/resetpassword/init with 202 — accepted, not completed. The 202 deliberately carries no information about whether the address belongs to an account: it is returned for an unknown email as well, so the endpoint is not an enumeration oracle. Non-2xx here means the request itself was unusable (missing email, reset not configured for the shop), never "no such user".

  • acceptedboolean

    Always true; means "the request was accepted", not "an email was sent".

CustomerPasswordResetResponse

Envelope returned by POST customer/account/resetpassword/finish with 200. The new password is in effect immediately; previously issued refresh tokens are not revoked by this call.

  • resetboolean

    Always true on a 200.

CustomerRegisteredResponse

Envelope returned by POST customer/account/register with 201. The account exists but is not yet usable: a confirmation email has been sent, and — when the shop requires confirmation — token issuance fails until register/confirm succeeds. An existing email is a 409, not a 201.

  • registeredboolean

    Always true; a failed registration is a non-2xx with the { errors } envelope.

ForgotPasswordRequest

Body for POST customer/account/resetpassword/init.

  • emailstringnullable
  • callback_url_templatestringnullable

RegisterRequest

Body for POST customer/account/register.

  • emailstringnullable
  • passwordstringnullable
  • callback_url_templatestringnullable

ResetPasswordRequest

Body for POST customer/account/resetpassword/finish.

  • emailstringnullable
  • tokenstringnullable
  • passwordstringnullable