Skip to content

Affiliate API

The Affiliate API lets an external affiliate integration read its referred customers and their financial transactions. It uses a dedicated revocable JWT issued by a manager. Affiliate cabinet login sessions are not accepted by these integration endpoints.

Authorization

Send the token directly in the Authorization header. The API does not use the Bearer scheme.

Authorization: {JWT_TOKEN}

The token is bound to one affiliate and one brand. The server derives both values from the verified token; request parameters cannot select another affiliate or brand.

A token may contain these scopes:

Scope Grants access to
customers:read GET /api/affiliate/v1/customers
transactions:read GET /api/affiliate/v1/transactions and GET /api/affiliate/v1/first-deposits

Every request verifies the JWT signature and checks the token record, owner, brand, scope, expiration, revocation status, active affiliate status, and active affiliate access to the brand. Revocation therefore takes effect on the next request.

Issuing and revoking tokens

Managers control tokens through:

The complete JWT is returned when it is created. An authenticated affiliate can also retrieve a usable token from the Affiliate API page in the cabinet. Revoked and expired token records are displayed without a token value. CRM token list responses contain metadata only.

The affiliate cabinet does not issue or revoke tokens; those operations remain manager-controlled.

Pagination

The list endpoints follow the platform table convention and require limit and offset. Responses contain rows and count, where count is the total number of matching records before pagination. limit accepts 1–500; offset must be zero or greater.

Time filtering

Both integration endpoints accept the optional from_time and to_time query parameters, integer Unix timestamps that filter on the record's created_time. Both bounds are inclusive. A zero, or an omitted parameter, means that bound is not applied, so from_time=1791936000&to_time=0 is a valid request with no upper bound.

count reflects the filtered set, not the whole history.

An invalid bound is rejected with 400 INVALID_DATA rather than ignored. Three cases are refused:

  • a non-numeric value: a string, a fractional number, a boolean, null, or an array. A date such as 2024-01-01 and a quoted number are both rejected;
  • a negative value;
  • an inverted range, where from_time is greater than to_time and both are non-zero.

Endpoints