Customers

List a shopper's delivered items

Return the downloads, codes, event tickets and services the shopper has bought, across their orders, newest first. Each purchased unit is one entry, so an order line of three event tickets lists three entries. An entry is preparing until the item is delivered, then delivered, and voided after a refund or return.

A digital entry lists its files, each with a download_url. A code entry shows its codes masked and a reveal_url; read the codes themselves with POST /v1/customers/{id}/fulfilments/{fulfilment_id}/reveal. An event_ticket entry lists its tickets with the text to encode as the QR code. A service entry carries the merchant’s confirmation note.

Customer-self access. Works with a publishable key (safe from the browser). Provide the shopper’s session token in the x-auth-token header (or the store’s bring-your-own-auth assertion in x-external-auth, never both); it must resolve to the customer in the {id} path parameter, otherwise the request returns 403. A Connect key needs the fulfilment:read scope.

GET

customers

{id}

fulfilments

List a shopper's delivered items

curl --request GET \
  --url https://api.tybritelabs.com/v1/customers/{id}/fulfilments \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.tybritelabs.com/v1/customers/{id}/fulfilments', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/fulfilments",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/fulfilments"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/fulfilments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "fulfilments": [
    {
      "id": "3b7c2f60-5d1a-4e8b-9c42-7a1d0e6f8b21",
      "order_id": "922d235e-48c9-4933-abcd-88cb2a264f86",
      "order_number": "ORD-1771523999910",
      "item_name": "Photography Course",
      "unit_no": 1,
      "kind": "digital",
      "status": "delivered",
      "created_at": "2026-10-28T10:30:00+00:00",
      "delivered_at": "2026-10-28T10:30:04+00:00",
      "downloads": [
        {
          "asset_id": "0c9d4e21-7b3a-4f15-8e60-2a5b6c7d8e90",
          "file_name": "lesson-1.pdf",
          "content_type": "application/pdf",
          "bytes": 482113,
          "available": true,
          "download_url": "https://api.example.com/v1/fulfilment/downloads/3b7c2f60-5d1a-4e8b-9c42-7a1d0e6f8b21/0c9d4e21-7b3a-4f15-8e60-2a5b6c7d8e90?t=Zk3q9XvL2mPaT7uRw1Yb8A"
        }
      ]
    }
  ],
  "has_more": false
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

The signed-in shopper's session token. Must resolve to the customer in the {id} path parameter. Send exactly one shopper credential.

x-external-auth

string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider.

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Send exactly one shopper credential.

x-idp-token

string

A raw token from the store's own identity provider, verified through the store's Auth verifier (fail-closed). Resolves the same shopper as x-auth-token. Send exactly one shopper credential.

Path Parameters

string<uuid>

required

The shopper's customer id.

Query Parameters

limit

integer

default:50

Number of entries to return, from 1 to 100.

Required range: 1 <= x <= 100

order_id

string<uuid>

Return only the entries of this order.

Response

The shopper's delivered items.

fulfilments

object[]

required

Show child attributes

has_more

boolean

required

Whether the shopper has older entries than the ones returned.

List a shopper's delivered items

curl --request GET \
  --url https://api.tybritelabs.com/v1/customers/{id}/fulfilments \
  --header 'Authorization: Bearer <token>'

const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.tybritelabs.com/v1/customers/{id}/fulfilments', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/fulfilments",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "GET",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/fulfilments"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/fulfilments")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "fulfilments": [
    {
      "id": "3b7c2f60-5d1a-4e8b-9c42-7a1d0e6f8b21",
      "order_id": "922d235e-48c9-4933-abcd-88cb2a264f86",
      "order_number": "ORD-1771523999910",
      "item_name": "Photography Course",
      "unit_no": 1,
      "kind": "digital",
      "status": "delivered",
      "created_at": "2026-10-28T10:30:00+00:00",
      "delivered_at": "2026-10-28T10:30:04+00:00",
      "downloads": [
        {
          "asset_id": "0c9d4e21-7b3a-4f15-8e60-2a5b6c7d8e90",
          "file_name": "lesson-1.pdf",
          "content_type": "application/pdf",
          "bytes": 482113,
          "available": true,
          "download_url": "https://api.example.com/v1/fulfilment/downloads/3b7c2f60-5d1a-4e8b-9c42-7a1d0e6f8b21/0c9d4e21-7b3a-4f15-8e60-2a5b6c7d8e90?t=Zk3q9XvL2mPaT7uRw1Yb8A"
        }
      ]
    }
  ],
  "has_more": false
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

List a shopper's delivered items

Authorizations

Headers

Path Parameters

Query Parameters

Response