Skip to main content
GET
Get customer details

Authorizations

Authorization
string
header
required

API Key Authentication

Use your API key in the Authorization header:

Key Types:

Secret Keys (Server-Side Only):

  • Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
  • Full read/write access to all endpoints
  • ⚠️ NEVER expose in client-side code or public repositories
  • Required for: write operations, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

  • Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
  • Read-only access (GET requests only, plus POST semantic search)
  • ✅ Safe for client-side JavaScript, mobile apps, and public code
  • Allowed for: browsing products, search, CMS content, pricing queries

Endpoint-Specific Requirements:

  • Authentication endpoints (/v1/auth/*): Secret key required
  • Payment verification (POST /v1/payments/verify): Secret key required
  • AI Recommendations (POST /v1/recommendations): Secret key required
  • Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
  • All write operations: Secret key required
  • All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token
string

Galactic Core customer session access_token from /v1/auth/login or /v1/auth/verify-otp. The resolved customer must match the {id} path parameter. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-external-auth
string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider (Auth0, Clerk, Cognito, Firebase, NextAuth, SSO).

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-idp-token
string

A raw token from the store's own identity provider (e.g. a Firebase ID token). Galactic Core forwards it to the store's configured Auth verifier, which validates it against the provider and returns the identity; the resolved customer must match the {id} path parameter.

Use this when the store wants Galactic Core to verify tokens on its behalf rather than signing an assertion itself. Verification is fail-closed: if the verifier rejects the token or is unreachable, the request is unauthenticated (401). Requires an Auth verifier to be configured for the store. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

Path Parameters

id
string<uuid>
required

Query Parameters

fields
string

Comma-separated list of fields to include in the response.

Allowed Fields:

  • id, name, email, phone, address, status
  • join_date, total_purchases, last_purchase
  • created_at, updated_at
  • store_metrics, store_metrics.*

Response

Success

id
string<uuid>
name
string
email
string<email>
phone
string
address
string | null

The customer's address, or null if not on file.

status
enum<string>
Available options:
active,
inactive
custom_fields
object[]

The merchant's own fields on this record, with their values. Only fields the merchant published appear here. The merchant controls the names and how many exist, so render the array rather than reading fixed keys.

tier
enum<string>

The customer's loyalty/spend tier, derived from their purchase history. New customers start at bronze.

Available options:
bronze,
silver,
gold,
platinum
Example:

"bronze"

join_date
string<date>
external_id
string | null

Optional identifier from an external identity provider (Auth0, Clerk, Cognito, Firebase, NextAuth, etc). Unique per store + environment. Set this when you manage authentication outside Galactic Core and need a stable handle to map your upstream user back to the Galactic Core customer record.

Example:

"auth0|66a3f8c2b1d9c204a1f7e3d1"

Whether the customer has opted in to marketing communications. Defaults to false (opt-in). Set this from your storefront's marketing opt-in checkbox at sign-up, checkout, or in the customer's account preferences. When true, the customer is eligible to be subscribed to the store's connected marketing tools.

Example:

true

total_purchases
integer
last_purchase
string<date-time> | null

Timestamp of the customer's most recent purchase, or null if they have not purchased yet.

store_credit_balance
number

The customer's total redeemable store-credit balance. Store credit is issued when a customer accepts a store-credit offer on a return, and can be applied at checkout (see apply_store_credit on POST /v1/orders).

Example:

25

created_at
string<date-time>
updated_at
string<date-time>
store_metrics
object | null

Aggregated purchase metrics for the customer, or null until they have purchase history.

environment
enum<string>

Whether this customer record belongs to the live or test environment.

Available options:
production,
sandbox
Example:

"production"