Customers

Reveal the codes of a delivered item

Return the codes of one code entry in clear, for example a licence key or a voucher code. Each reveal is recorded and is limited per shopper and per address; the response is never cached. An entry that is not the shopper’s reads as 404, and an entry that was refunded or whose codes are not available answers 409 or 410 with a sentence for the shopper.

Customer-self access. Works with a publishable key (safe from the browser). Provide the shopper’s session token in the x-auth-token header (or the store’s bring-your-own-auth assertion in x-external-auth, never both); it must resolve to the customer in the {id} path parameter, otherwise the request returns 403. A Connect key needs the fulfilment:read scope.

POST

customers

{id}

fulfilments

{fulfilment_id}

reveal

Reveal the codes of a delivered item

curl --request POST \
  --url https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "codes": [
    {
      "label": "Licence key",
      "code": "ABCD-EFGH-IJKL-MNOP"
    }
  ]
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

The signed-in shopper's session token. Must resolve to the customer in the {id} path parameter. Send exactly one shopper credential.

x-external-auth

string

Bring-your-own-auth assertion for stores that manage authentication in an external identity provider.

Format: <base64url(JSON)>.<base64url(HMAC-SHA256(JSON))> where the JSON is { "external_id": "...", "iat": <unix>, "exp": <unix> } and the HMAC is keyed on the store's hmac_secret. Claim lifetime capped at 300 seconds. Send exactly one shopper credential.

x-idp-token

string

A raw token from the store's own identity provider, verified through the store's Auth verifier (fail-closed). Resolves the same shopper as x-auth-token. Send exactly one shopper credential.

Path Parameters

string<uuid>

required

The shopper's customer id.

fulfilment_id

string<uuid>

required

The entry's id from the list of delivered items.

Response

The entry's codes.

codes

object[]

required

Show child attributes

Reveal the codes of a delivered item

curl --request POST \
  --url https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/customers/{id}/fulfilments/{fulfilment_id}/reveal")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "codes": [
    {
      "label": "Licence key",
      "code": "ABCD-EFGH-IJKL-MNOP"
    }
  ]
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Reveal the codes of a delivered item

Authorizations

Headers

Path Parameters

Response