Returns

Lodge a return

Lodges a return request against one of the authenticated customer’s own online orders. The return is created with status: "pending" for the merchant to review.

On a marketplace (a marketplace key with store_id), the order is one the shopper bought through the marketplace: it must belong to a purchase placed with the shopper’s credential, or — for a guest purchase — made with an email address the shopper has verified. The shopper has no customer record with the merchant, and the return is refund-only: return_type: "store_credit" answers 400. A marketplace credit is issued to the shopper’s marketplace wallet through a dispute (see GET /v1/customers/me/wallet).

Authentication: API key in the Authorization: Bearer header and a customer session — either x-auth-token or x-external-auth.

Order ownership: order_id must reference an online order belonging to the authenticated customer, and each items[].order_item_id must be a line on that order. An order that does not exist or does not belong to the customer returns 404.

Reason description: reason_description is required only when reason_code is other; for every other reason it is optional.

Returns availability: if the store has returns turned off, the request returns 422 with code returns_disabled.

After lodging a return the customer can only track its status — approving, issuing refunds or store credit, restocking, and rejecting items are handled by the merchant in their admin.

POST

returns

Lodge a return

curl --request POST \
  --url https://api.tybritelabs.com/v1/returns \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "order_id": "770a0622-0401-63f6-c938-557766551111",
  "reason_code": "damaged",
  "return_type": "full_refund",
  "items": [
    {
      "order_item_id": "9c4f1d2e-aaaa-bbbb-cccc-1234567890ab",
      "quantity": 1,
      "condition": "damaged",
      "media": [
        "https://cdn.tybritelabs.com/return-photo-1.jpg"
      ]
    }
  ]
}
'

import requests

url = "https://api.tybritelabs.com/v1/returns"

payload = {
    "order_id": "770a0622-0401-63f6-c938-557766551111",
    "reason_code": "damaged",
    "return_type": "full_refund",
    "items": [
        {
            "order_item_id": "9c4f1d2e-aaaa-bbbb-cccc-1234567890ab",
            "quantity": 1,
            "condition": "damaged",
            "media": ["https://cdn.tybritelabs.com/return-photo-1.jpg"]
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    order_id: '770a0622-0401-63f6-c938-557766551111',
    reason_code: 'damaged',
    return_type: 'full_refund',
    items: [
      {
        order_item_id: '9c4f1d2e-aaaa-bbbb-cccc-1234567890ab',
        quantity: 1,
        condition: 'damaged',
        media: ['https://cdn.tybritelabs.com/return-photo-1.jpg']
      }
    ]
  })
};

fetch('https://api.tybritelabs.com/v1/returns', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/returns",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'order_id' => '770a0622-0401-63f6-c938-557766551111',
    'reason_code' => 'damaged',
    'return_type' => 'full_refund',
    'items' => [
        [
                'order_item_id' => '9c4f1d2e-aaaa-bbbb-cccc-1234567890ab',
                'quantity' => 1,
                'condition' => 'damaged',
                'media' => [
                                'https://cdn.tybritelabs.com/return-photo-1.jpg'
                ]
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/returns"

	payload := strings.NewReader("{\n  \"order_id\": \"770a0622-0401-63f6-c938-557766551111\",\n  \"reason_code\": \"damaged\",\n  \"return_type\": \"full_refund\",\n  \"items\": [\n    {\n      \"order_item_id\": \"9c4f1d2e-aaaa-bbbb-cccc-1234567890ab\",\n      \"quantity\": 1,\n      \"condition\": \"damaged\",\n      \"media\": [\n        \"https://cdn.tybritelabs.com/return-photo-1.jpg\"\n      ]\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/returns")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"order_id\": \"770a0622-0401-63f6-c938-557766551111\",\n  \"reason_code\": \"damaged\",\n  \"return_type\": \"full_refund\",\n  \"items\": [\n    {\n      \"order_item_id\": \"9c4f1d2e-aaaa-bbbb-cccc-1234567890ab\",\n      \"quantity\": 1,\n      \"condition\": \"damaged\",\n      \"media\": [\n        \"https://cdn.tybritelabs.com/return-photo-1.jpg\"\n      ]\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/returns")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"order_id\": \"770a0622-0401-63f6-c938-557766551111\",\n  \"reason_code\": \"damaged\",\n  \"return_type\": \"full_refund\",\n  \"items\": [\n    {\n      \"order_item_id\": \"9c4f1d2e-aaaa-bbbb-cccc-1234567890ab\",\n      \"quantity\": 1,\n      \"condition\": \"damaged\",\n      \"media\": [\n        \"https://cdn.tybritelabs.com/return-photo-1.jpg\"\n      ]\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "id": "1adc3367-bbc5-4a44-a8a4-9b2484a96454",
    "return_number": "RET-20260620-25f5f8",
    "order_id": "0bce8f80-1f44-434c-8e1b-a1203b1a3377",
    "channel": "online",
    "status": "pending",
    "return_type": "full_refund",
    "reason_code": "damaged",
    "reason_description": null,
    "total_return_amount": 299,
    "refund_amount": 299,
    "refund_method": null,
    "created_at": "2026-06-20T13:49:26.887932+00:00",
    "processed_at": null,
    "credit_offer": {
      "status": "none",
      "amount": null
    },
    "items": [
      {
        "id": "b29e5c83-6278-43fd-92d9-d9fbd62b5400",
        "order_item_id": "50a12a84-4f95-4e46-84d2-8e6df748c3f5",
        "product_name": "Samsung Galaxy Watch 6",
        "quantity": 1,
        "unit_price": 299,
        "return_amount": 299,
        "condition": "damaged",
        "status": "pending",
        "rejection_reason": null,
        "media": []
      }
    ]
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request parameters",
    "details": "The 'email' field is required"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "This operation requires a secret key. Publishable keys cover catalogue reads and the actions a shopper takes for themselves."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Resource not found"
  }
}

{
  "error": {
    "code": "returns_disabled",
    "message": "Returns are not enabled for this store."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key. Please slow down and try again shortly.",
    "remaining": 0,
    "reset": 1706198400
  }
}

{
  "error": {
    "code": "server_error",
    "message": "An unexpected error occurred"
  }
}

Authorizations

Authorization

string

header

required

API Key Authentication

Use your API key in the Authorization header:

Authorization: Bearer tybrite_sk_live_YOUR_KEY

Key Types:

Secret Keys (Server-Side Only):

Format: tybrite_sk_live_* (production) or tybrite_sk_test_* (sandbox)
Full read/write access to all endpoints
⚠️ NEVER expose in client-side code or public repositories
Required for: every write a shopper does not make for themselves, authentication, payment verification, AI recommendations

Publishable Keys (Client-Safe):

Format: tybrite_pk_live_* (production) or tybrite_pk_test_* (sandbox)
Catalogue reads, plus the actions a shopper takes for themselves
✅ Safe for client-side JavaScript, mobile apps, and public code
Allowed for: browsing products, search, CMS content, pricing queries, cart and wishlist, reviews, storefront events, and the Agent API's quotes, cart drafts and checkout intents

Endpoint-Specific Requirements:

Authentication endpoints (/v1/auth/*): Secret key required
Payment verification (POST /v1/payments/verify): Secret key required
AI Recommendations (POST /v1/recommendations): Secret key required
Semantic Search (POST /v1/search): Both key types allowed (read-only operation)
Shopper actions (cart, wishlist, reviews, storefront events, Agent API quotes, cart drafts and checkout intents): Both key types allowed
All other write operations: Secret key required
All read operations: Both key types allowed

Using a publishable key for restricted operations returns 403 Forbidden.

Headers

x-auth-token

string

Customer session token from POST /v1/auth/login or POST /v1/auth/verify-otp. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-external-auth

string

Bring-your-own-auth assertion identifying the customer. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

x-idp-token

string

A raw token from the store's own identity provider (e.g. a Firebase ID token). Galactic Core forwards it to the store's configured Auth verifier, which validates it and returns the identity.

Verification is fail-closed: if the verifier rejects the token or is unreachable, the request is unauthenticated (401). Requires an Auth verifier to be configured for the store. Provide exactly one of x-auth-token, x-external-auth, or x-idp-token.

Query Parameters

store_id

string<uuid>

Marketplace operator key only — and required for operator keys. On a marketplace storefront, the merchant the order belongs to. Ignored for single-store keys.

Body

application/json

order_id

string<uuid>

required

The customer's online order the return is for.

Example:

"770a0622-0401-63f6-c938-557766551111"

reason_code

enum<string>

required

Why the items are being returned.

Available options:

damaged,

defective,

wrong_item,

not_as_described,

wrong_size,

no_longer_needed,

arrived_late,

other

Example:

"damaged"

items

object[]

required

The order lines being returned.

Minimum array length: 1

Show child attributes

reason_description

string

Free-text explanation. Required when reason_code is other; optional otherwise.

Example:

"The box was crushed in transit."

return_type

enum<string>

default:full_refund

The resolution the customer is requesting.

Available options:

full_refund,

partial_refund,

exchange,

store_credit

Example:

"full_refund"

Response

Return lodged

data

object

required

Show child attributes

Lodge a return

curl --request POST \
  --url https://api.tybritelabs.com/v1/returns \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "order_id": "770a0622-0401-63f6-c938-557766551111",
  "reason_code": "damaged",
  "return_type": "full_refund",
  "items": [
    {
      "order_item_id": "9c4f1d2e-aaaa-bbbb-cccc-1234567890ab",
      "quantity": 1,
      "condition": "damaged",
      "media": [
        "https://cdn.tybritelabs.com/return-photo-1.jpg"
      ]
    }
  ]
}
'

import requests

url = "https://api.tybritelabs.com/v1/returns"

payload = {
    "order_id": "770a0622-0401-63f6-c938-557766551111",
    "reason_code": "damaged",
    "return_type": "full_refund",
    "items": [
        {
            "order_item_id": "9c4f1d2e-aaaa-bbbb-cccc-1234567890ab",
            "quantity": 1,
            "condition": "damaged",
            "media": ["https://cdn.tybritelabs.com/return-photo-1.jpg"]
        }
    ]
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({
    order_id: '770a0622-0401-63f6-c938-557766551111',
    reason_code: 'damaged',
    return_type: 'full_refund',
    items: [
      {
        order_item_id: '9c4f1d2e-aaaa-bbbb-cccc-1234567890ab',
        quantity: 1,
        condition: 'damaged',
        media: ['https://cdn.tybritelabs.com/return-photo-1.jpg']
      }
    ]
  })
};

fetch('https://api.tybritelabs.com/v1/returns', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.tybritelabs.com/v1/returns",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'order_id' => '770a0622-0401-63f6-c938-557766551111',
    'reason_code' => 'damaged',
    'return_type' => 'full_refund',
    'items' => [
        [
                'order_item_id' => '9c4f1d2e-aaaa-bbbb-cccc-1234567890ab',
                'quantity' => 1,
                'condition' => 'damaged',
                'media' => [
                                'https://cdn.tybritelabs.com/return-photo-1.jpg'
                ]
        ]
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.tybritelabs.com/v1/returns"

	payload := strings.NewReader("{\n  \"order_id\": \"770a0622-0401-63f6-c938-557766551111\",\n  \"reason_code\": \"damaged\",\n  \"return_type\": \"full_refund\",\n  \"items\": [\n    {\n      \"order_item_id\": \"9c4f1d2e-aaaa-bbbb-cccc-1234567890ab\",\n      \"quantity\": 1,\n      \"condition\": \"damaged\",\n      \"media\": [\n        \"https://cdn.tybritelabs.com/return-photo-1.jpg\"\n      ]\n    }\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.tybritelabs.com/v1/returns")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"order_id\": \"770a0622-0401-63f6-c938-557766551111\",\n  \"reason_code\": \"damaged\",\n  \"return_type\": \"full_refund\",\n  \"items\": [\n    {\n      \"order_item_id\": \"9c4f1d2e-aaaa-bbbb-cccc-1234567890ab\",\n      \"quantity\": 1,\n      \"condition\": \"damaged\",\n      \"media\": [\n        \"https://cdn.tybritelabs.com/return-photo-1.jpg\"\n      ]\n    }\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.tybritelabs.com/v1/returns")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"order_id\": \"770a0622-0401-63f6-c938-557766551111\",\n  \"reason_code\": \"damaged\",\n  \"return_type\": \"full_refund\",\n  \"items\": [\n    {\n      \"order_item_id\": \"9c4f1d2e-aaaa-bbbb-cccc-1234567890ab\",\n      \"quantity\": 1,\n      \"condition\": \"damaged\",\n      \"media\": [\n        \"https://cdn.tybritelabs.com/return-photo-1.jpg\"\n      ]\n    }\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "id": "1adc3367-bbc5-4a44-a8a4-9b2484a96454",
    "return_number": "RET-20260620-25f5f8",
    "order_id": "0bce8f80-1f44-434c-8e1b-a1203b1a3377",
    "channel": "online",
    "status": "pending",
    "return_type": "full_refund",
    "reason_code": "damaged",
    "reason_description": null,
    "total_return_amount": 299,
    "refund_amount": 299,
    "refund_method": null,
    "created_at": "2026-06-20T13:49:26.887932+00:00",
    "processed_at": null,
    "credit_offer": {
      "status": "none",
      "amount": null
    },
    "items": [
      {
        "id": "b29e5c83-6278-43fd-92d9-d9fbd62b5400",
        "order_item_id": "50a12a84-4f95-4e46-84d2-8e6df748c3f5",
        "product_name": "Samsung Galaxy Watch 6",
        "quantity": 1,
        "unit_price": 299,
        "return_amount": 299,
        "condition": "damaged",
        "status": "pending",
        "rejection_reason": null,
        "media": []
      }
    ]
  }
}

{
  "error": {
    "code": "invalid_request",
    "message": "Invalid request parameters",
    "details": "The 'email' field is required"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing or invalid Authorization header"
  }
}

{
  "error": {
    "code": "forbidden",
    "message": "This operation requires a secret key. Publishable keys cover catalogue reads and the actions a shopper takes for themselves."
  }
}

{
  "error": {
    "code": "not_found",
    "message": "Resource not found"
  }
}

{
  "error": {
    "code": "returns_disabled",
    "message": "Returns are not enabled for this store."
  }
}

{
  "error": {
    "code": "rate_limited",
    "message": "Too many requests for this API key. Please slow down and try again shortly.",
    "remaining": 0,
    "reset": 1706198400
  }
}

{
  "error": {
    "code": "server_error",
    "message": "An unexpected error occurred"
  }
}

Reference

System

Store

Products

Taxonomy

Orders

Payments

Cart & Wishlist

Marketplace

Recommendations

Discovery

Events

Tax

Analytics

Agent

Search

Authentication

Customers

Gift Cards

Promotions

Campaigns

CMS

Pricing

Messaging

Shipping

GC Connect

Reviews

Returns

Disputes

B2B

Webhooks

Ingestion

Feeds

Sandbox

Lodge a return

Authorizations

Headers

Query Parameters

Body

Response