Customers

Get a Subscribe & Save subscription

Return one of the signed-in shopper’s subscriptions.

Customer-self access. Works with a publishable key (safe from the browser). Provide the shopper’s session token in the x-auth-token header (or the store’s bring-your-own-auth assertion in x-external-auth); it must resolve to the customer in the {id} path parameter, otherwise the request returns 403. A subscription that belongs to another shopper reads as 404.

GET

customers

{id}

shopper-subscriptions

{subscriptionId}

Get a Subscribe & Save subscription

curl --request GET \
  --url https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId} \
  --header 'Authorization: Bearer <token>' \
  --header 'x-auth-token: <x-auth-token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}"

headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {'x-auth-token': '<x-auth-token>', Authorization: 'Bearer <token>'}
};

fetch('https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "subscription": {
    "id": "8d6a1c52-0b8f-4e63-a1f4-2c9d7e5b3a10",
    "status": "active",
    "offer_id": "4c1c7b9e-2f58-4f43-9d3a-6f0e2a8b1c11",
    "offer_label": "Subscribe & save 15%",
    "interval_unit": "month",
    "interval_count": 1,
    "next_delivery_on": "2026-11-28",
    "fulfillment_method": "delivery",
    "shipping_address_id": "c176eadf-13e3-4bdc-ba5b-06cfa3f2fcb9",
    "pickup_location_id": null,
    "renewal_mode": "off_session",
    "payment_method": {
      "id": "5a0e2d7c-91b4-4c3a-8e6f-1d2b3c4a5e60",
      "brand": "visa",
      "last4": "4242",
      "exp_month": 12,
      "exp_year": 2028
    },
    "terms": {
      "offer_name": "Monthly coffee",
      "discount_type": "percentage",
      "discount_value": 1500,
      "first_order_discount_value": 2000,
      "min_cycles": 0,
      "max_skips_per_year": 4,
      "free_shipping": false,
      "stacks_with_promotions": false,
      "interval_unit": "month",
      "interval_count": 1
    },
    "deliveries_completed": 3,
    "paused_until": null,
    "cancel_effective_on": null,
    "created_at": "2026-08-28T09:30:00+00:00",
    "items": [
      {
        "product_id": "715b8c10-eb11-4289-8c0e-2966e78cf9a5",
        "variant_id": "15ca5a86-4b1b-47c3-8762-a1aa43941565",
        "quantity": 2,
        "name": "Colombian Roast 1 kg"
      }
    ],
    "pending_action": null
  }
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

required

The signed-in shopper's session token, obtained when the shopper logs in. Must resolve to the customer in the {id} path parameter.

x-external-auth

string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider (Auth0, Clerk, Cognito, Firebase, NextAuth, SSO). Resolves the shopper whose subscriptions are managed.

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-idp-token

string

A raw token from the store's own identity provider (e.g. a Firebase ID token). Galactic Core forwards it to the store's configured Auth verifier, which validates it against the provider and returns the identity; resolves the shopper whose subscriptions are managed.

Use this when the store wants Galactic Core to verify tokens on its behalf rather than signing an assertion itself. Verification is fail-closed: if the verifier rejects the token or is unreachable, the request is unauthenticated (401). Requires an Auth verifier to be configured for the store. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

Path Parameters

string<uuid>

required

The shopper's customer id.

subscriptionId

string<uuid>

required

The id of the Subscribe & Save subscription.

Response

The subscription.

subscription

object

required

A shopper's Subscribe & Save subscription: a recurring delivery they agreed to, with the terms accepted at sign-up. Each delivery after the first is an ordinary order for the store.

status is active, paused, past_due (a delivery could not be paid and is being retried), cancelled or ended. renewal_mode is off_session when a saved card is charged for each delivery, or confirm when the shopper pays each delivery from a link sent to them.

Show child attributes

Get a Subscribe & Save subscription

curl --request GET \
  --url https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId} \
  --header 'Authorization: Bearer <token>' \
  --header 'x-auth-token: <x-auth-token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}"

headers = {
    "x-auth-token": "<x-auth-token>",
    "Authorization": "Bearer <token>"
}

response = requests.get(url, headers=headers)

print(response.text)

const options = {
  method: 'GET',
  headers: {'x-auth-token': '<x-auth-token>', Authorization: 'Bearer <token>'}
};

fetch('https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "x-auth-token: <x-auth-token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("x-auth-token", "<x-auth-token>")
	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.get("https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}")
  .header("x-auth-token", "<x-auth-token>")
  .header("Authorization", "Bearer <token>")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/shopper-subscriptions/{subscriptionId}")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["x-auth-token"] = '<x-auth-token>'
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "subscription": {
    "id": "8d6a1c52-0b8f-4e63-a1f4-2c9d7e5b3a10",
    "status": "active",
    "offer_id": "4c1c7b9e-2f58-4f43-9d3a-6f0e2a8b1c11",
    "offer_label": "Subscribe & save 15%",
    "interval_unit": "month",
    "interval_count": 1,
    "next_delivery_on": "2026-11-28",
    "fulfillment_method": "delivery",
    "shipping_address_id": "c176eadf-13e3-4bdc-ba5b-06cfa3f2fcb9",
    "pickup_location_id": null,
    "renewal_mode": "off_session",
    "payment_method": {
      "id": "5a0e2d7c-91b4-4c3a-8e6f-1d2b3c4a5e60",
      "brand": "visa",
      "last4": "4242",
      "exp_month": 12,
      "exp_year": 2028
    },
    "terms": {
      "offer_name": "Monthly coffee",
      "discount_type": "percentage",
      "discount_value": 1500,
      "first_order_discount_value": 2000,
      "min_cycles": 0,
      "max_skips_per_year": 4,
      "free_shipping": false,
      "stacks_with_promotions": false,
      "interval_unit": "month",
      "interval_count": 1
    },
    "deliveries_completed": 3,
    "paused_until": null,
    "cancel_effective_on": null,
    "created_at": "2026-08-28T09:30:00+00:00",
    "items": [
      {
        "product_id": "715b8c10-eb11-4289-8c0e-2966e78cf9a5",
        "variant_id": "15ca5a86-4b1b-47c3-8762-a1aa43941565",
        "quantity": 2,
        "name": "Colombian Roast 1 kg"
      }
    ],
    "pending_action": null
  }
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Get a Subscribe & Save subscription

Authorizations

Headers

Path Parameters

Response