Check whether an order can still be returned
Answers the order-level question — can this order still be returned, and until when? — before a shopper is shown a return form.
This is the companion to features.returns_window_days on getStoreInfo, and the two are
deliberately different. That field is the store’s policy (“30 days”), a store-level fact you
render on a product page. This is the verdict for one order, which depends on when that
particular parcel was delivered and therefore cannot be cached alongside the policy.
Use it so a storefront never offers a return the API will refuse. The same window is enforced when the return is lodged, so this reads the rule ahead of time rather than duplicating it: a request made after the window is rejected with the date it closed.
When window_days is null the merchant has stated no period, eligible is true, and
closes_at is null — say returns are accepted without naming a deadline.
Customer session required — the order must belong to the signed-in shopper, so this can never be used to probe whether an arbitrary order id exists on the store.
Authorizations
API Key Authentication
Use your API key in the Authorization header:
Key Types:
Secret Keys (Server-Side Only):
- Format:
tybrite_sk_live_*(production) ortybrite_sk_test_*(sandbox) - Full read/write access to all endpoints
- ⚠️ NEVER expose in client-side code or public repositories
- Required for: write operations, authentication, payment verification, AI recommendations
Publishable Keys (Client-Safe):
- Format:
tybrite_pk_live_*(production) ortybrite_pk_test_*(sandbox) - Read-only access (GET requests only, plus POST semantic search)
- ✅ Safe for client-side JavaScript, mobile apps, and public code
- Allowed for: browsing products, search, CMS content, pricing queries
Endpoint-Specific Requirements:
- Authentication endpoints (
/v1/auth/*): Secret key required - Payment verification (
POST /v1/payments/verify): Secret key required - AI Recommendations (
POST /v1/recommendations): Secret key required - Semantic Search (
POST /v1/search): Both key types allowed (read-only operation) - All write operations: Secret key required
- All read operations: Both key types allowed
Using a publishable key for restricted operations returns 403 Forbidden.
Headers
Customer session token from POST /v1/auth/login or
POST /v1/auth/verify-otp. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.
Bring-your-own-auth assertion identifying the customer. Provide exactly one of
x-auth-token, x-external-auth, or x-idp-token.
A raw token from the store's own identity provider (e.g. a Firebase ID token). Galactic Core forwards it to the store's configured Auth verifier, which validates it and returns the identity.
Verification is fail-closed: if the verifier rejects the token or is unreachable, the request is unauthenticated (401). Requires an Auth verifier to be configured for the store. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.
Query Parameters
The online order to check. Must belong to the authenticated customer.
Response
Eligibility resolved

