API reference / Stores

Store team

8 operations.

GET/api/v1/store-invites

List my team invitations

Signed in

Store teams that invited the caller’s confirmed email, newest first.

SDK: collector.listMyStoreInvites()
Key scopes: stores:read(API keys are coming soon)
Headers: If-None-MatchX-Request-Id

Responses

200Open invitations.
object
- invitesarray of MyStoreInviterequired
304Not modified: your copy (the ETag in If-None-Match) is current.

Errors (401, 500)

401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl 'https://collection.id/api/v1/store-invites' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN"

TypeScript SDK

await collector.listMyStoreInvites();

POST/api/v1/store-invites/{inviteId}/respond

Accept or decline an invitation

Signed in

Accepting joins the store’s team and answers its slug; declining answers slug: null.

SDK: collector.respondToStoreInvite()
Key scopes: stores:write(API keys are coming soon)
Headers: X-Request-Id

Parameters

Name	In	Type	About
`inviteId`required	path	string (uuid)

Request body (required, application/json)

object

acceptbooleanrequired

Responses

200The store’s slug after joining, or null after declining.
object
- slugstring or nullrequired

Errors (400, 401, 404, 409, 500)

400invalid_request invalid_json
invalid_request: The query or body doesn’t match the schema (see errors[]).
invalid_json: The body isn’t JSON.
401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
404not_found
not_found: Nothing at that address.
409invite_closed invite_expired already_member
invite_closed: It was already answered or withdrawn.
invite_expired: It expired.
already_member: The caller is already on the team.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl -X POST 'https://collection.id/api/v1/store-invites/<inviteId>/respond' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN" \
  -H 'Content-Type: application/json' \
  -d @body.json

TypeScript SDK

await collector.respondToStoreInvite({ path: { inviteId }, body: { … } });

GET/api/v1/stores/{storeId}/members

List the store’s team

Store member

People join by accepting an invitation, never directly.

SDK: collector.listStoreMembers()
Key scopes: store:staff:read(API keys are coming soon)
Headers: If-None-MatchX-Request-Id

Parameters

Name	In	Type	About
`storeId`required	path	string (uuid)

Responses

200The team.
object
- membersarray of StoreMemberrequired
304Not modified: your copy (the ETag in If-None-Match) is current.

Errors (401, 404, 500)

401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
404not_found
not_found: Nothing at that address.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl 'https://collection.id/api/v1/stores/<storeId>/members' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN"

TypeScript SDK

await collector.listStoreMembers({ path: { storeId } });

DELETE/api/v1/stores/{storeId}/members/{userId}

Remove a member, or leave

Store member

Owners remove people; anyone may remove themselves (leave). A store keeps at least one owner.

SDK: collector.removeStoreMember()
Key scopes: store:staff:write(API keys are coming soon)
Headers: X-Request-Id

Parameters

Name	In	Type	About
`storeId`required	path	string (uuid)
`userId`required	path	string (uuid)

Responses

200{ left: true } when the caller left, else the team after the change.
object or object
1. Option 1: object
  left"true"required
2. Option 2: object
  membersarray of StoreMemberrequired

Errors (401, 403, 404, 409, 500)

401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
403forbidden
forbidden: Only the owner can remove other people.
404not_found
not_found: Nothing at that address.
409last_owner owner_role
last_owner: A store needs an owner: add another before leaving.
owner_role: Owners can only leave on their own.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl -X DELETE 'https://collection.id/api/v1/stores/<storeId>/members/<userId>' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN"

TypeScript SDK

await collector.removeStoreMember({ path: { storeId, userId } });

PATCH/api/v1/stores/{storeId}/members/{userId}

Change a member’s role

Store member

Owners only. Owners keep the owner role.

SDK: collector.updateStoreMember()
Key scopes: store:staff:write(API keys are coming soon)
Headers: X-Request-Id

Parameters

Name	In	Type	About
`storeId`required	path	string (uuid)
`userId`required	path	string (uuid)

Request body (required, application/json)

object

roleenumrequired
One ofstaffadmin

Responses

200The team after the change.
object
- membersarray of StoreMemberrequired

Errors (400, 401, 403, 404, 409, 500)

400invalid_request invalid_json
invalid_request: The query or body doesn’t match the schema (see errors[]).
invalid_json: The body isn’t JSON.
401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
403forbidden
forbidden: Only the store’s owners can do this.
404not_found
not_found: Nothing at that address.
409owner_role
owner_role: Owners keep the owner role.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl -X PATCH 'https://collection.id/api/v1/stores/<storeId>/members/<userId>' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN" \
  -H 'Content-Type: application/json' \
  -d @body.json

TypeScript SDK

await collector.updateStoreMember({ path: { storeId, userId }, body: { … } });

GET/api/v1/stores/{storeId}/members/invites

List open invitations

Store member

Owners only: the invited email, role and expiry (never whether the email has an account).

SDK: collector.listStoreInvites()
Key scopes: store:staff:read(API keys are coming soon)
Headers: If-None-MatchX-Request-Id

Parameters

Name	In	Type	About
`storeId`required	path	string (uuid)

Responses

200Open invitations.
object
- invitesarray of StoreInviterequired
304Not modified: your copy (the ETag in If-None-Match) is current.

Errors (401, 403, 404, 500)

401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
403forbidden
forbidden: Only the store’s owners can do this.
404not_found
not_found: Nothing at that address.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl 'https://collection.id/api/v1/stores/<storeId>/members/invites' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN"

TypeScript SDK

await collector.listStoreInvites({ path: { storeId } });

POST/api/v1/stores/{storeId}/members/invites

Invite someone to the team

Store memberIdempotent

Owners only. Invites an email as staff or admin; the answer is the same whether or not the email has an account, and they join once they accept (invitations last 14 days).

SDK: collector.inviteStoreMember()
Key scopes: store:staff:write(API keys are coming soon)
Headers: Idempotency-KeyX-Request-Id

Parameters

Name	In	Type	About
`storeId`required	path	string (uuid)

Request body (required, application/json)

object

emailstringrequired
roleenumoptionaldefault "staff"
One ofstaffadmin

Responses

202Invited; the open invitations now.
object
- invitesarray of StoreInviterequired

Errors (400, 401, 403, 404, 409, 422, 429, 500)

400invalid_request invalid_json invalid_idempotency_key
invalid_request: The query or body doesn’t match the schema (see errors[]).
invalid_json: The body isn’t JSON.
invalid_idempotency_key: The Idempotency-Key isn’t 1–255 visible ASCII characters.
401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
403forbidden
forbidden: Only the store’s owners can do this.
404not_found
not_found: Nothing at that address.
409idempotency_in_progress already_member too_many_invites
idempotency_in_progress: The first request with this key is still running.
already_member: That email is already on the team.
too_many_invites: Too many open invitations.
422idempotency_key_reused
idempotency_key_reused: This key was used for a different request.
429rate_limited
rate_limited: Too many requests; wait the Retry-After seconds.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl -X POST 'https://collection.id/api/v1/stores/<storeId>/members/invites' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN" \
  -H "Idempotency-Key: $(uuidgen)" \
  -H 'Content-Type: application/json' \
  -d @body.json

TypeScript SDK

await collector.inviteStoreMember({ path: { storeId }, body: { … } });

DELETE/api/v1/stores/{storeId}/members/invites/{inviteId}

Withdraw an invitation

Store member

Owners only.

SDK: collector.revokeStoreInvite()
Key scopes: store:staff:write(API keys are coming soon)
Headers: X-Request-Id

Parameters

Name	In	Type	About
`storeId`required	path	string (uuid)
`inviteId`required	path	string (uuid)

Responses

200The open invitations after it.
object
- invitesarray of StoreInviterequired

Errors (401, 403, 404, 500)

401unauthorized
unauthorized: Not signed in (no session or token, or an expired one).
403forbidden
forbidden: Only the store’s owners can do this.
404not_found
not_found: Nothing at that address.
500internal
internal: Something went wrong on our side (quote the requestId).

curl

curl -X DELETE 'https://collection.id/api/v1/stores/<storeId>/members/invites/<inviteId>' \
  -H "Authorization: Bearer $COLLECTOR_TOKEN"

TypeScript SDK

await collector.revokeStoreInvite({ path: { storeId, inviteId } });