Customer
The account holds the data carried by the customer token, completed with the holder's stored data when the tenant identifies holders. The response always carries an authenticationToken the pages can reuse.
a JWT token describing the customer
Account returned.
A holder's account as the enrolment pages exchange it: a flat JSON object whose properties are the tenant's enrolment form fields, plus the well-known keys below.
No customer token (Authorization: neo-customer ...), or a token that identifies no holder.
The endpoint is not enabled for the tenant.
Over 300 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.
GET /api/{tenantId}/customer HTTP/1.1
Host: app.neostore.cloud
Authorization: Bearer YOUR_SECRET_TOKEN
Accept: */*
{
"ANY_ADDITIONAL_PROPERTY": "anything"
}Submits an enrolment form: validates the holder's data, identifies the holder, and, when a flow is named, creates or updates the holder in the customer directory.
The data is first validated against the tenant's rules. The holder is then identified by caller: A back-office user or API key with the tenant.customer:write scope (in-store enrolment): the account is completed with the holder's stored data. Without flow, the call returns 202 with userExists and the completed account under challenge.account. With flow, setting neo.createNew to true creates a new holder even when one already matches.A holder with a customer token: the token must identify the holder (401 otherwise).Any other caller: depending on the tenant's settings, the holder may have to confirm their identity first; the call then returns 202 and a verification message is sent to the holder. A 202 body is { "userExists": true|false|null, "challenge": ... }; for an email verification, challenge is { "email": ... }, and a link to continue is mailed to the holder.
Name of one of the tenant's customer registration flows. Omitted, the data is only validated and
completed, nothing is saved. Set, the flow creates or updates the holder (and typically issues the pass),
and the response carries neo.redirect = complete.
A holder's account as the enrolment pages exchange it: a flat JSON object whose properties are the tenant's enrolment form fields, plus the well-known keys below.
Account validated, and created or updated when a flow was named.
A holder's account as the enrolment pages exchange it: a flat JSON object whose properties are the tenant's enrolment form fields, plus the well-known keys below.
Verification required, or (for a back-office caller without flow) the lookup result.
Account data invalid (errors keyed by field, the empty key for the whole account), unknown flow, or account identifiers the tenant does not accept from a caller without a customer token.
A customer token that identifies no holder.
The endpoint is not enabled for the tenant.
Over 300 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.
POST /api/{tenantId}/customer HTTP/1.1
Host: app.neostore.cloud
Content-Type: application/json
Accept: */*
Content-Length: 38
{
"ANY_ADDITIONAL_PROPERTY": "anything"
}{
"ANY_ADDITIONAL_PROPERTY": "anything"
}Exchanges a proof of identity from a sign-in provider for a customer token valid 24 hours.
Send the returned token on the customer endpoints as Authorization: neo-customer <token>.
Sign-in provider: otp, hmac_email, apple, google, facebook,
line, actito, livestore, secutix.movementId. Only the providers enabled for
the tenant are available.
Token issued.
No provider, a body that is not JSON, or the provider rejected the data (problem invalid-credentials).
Over 50 requests per minute to this endpoint for the tenant (default limit); retry after Retry-After.
POST /api/{tenantId}/customer/authenticate HTTP/1.1
Host: app.neostore.cloud
Content-Type: application/json
Accept: */*
textLast updated