Collect a setup-checklist credit reward
- Credentials
- OAuth access token
- Scopes
settings:write- Role
- Owners and admins only. Staff get
403 forbidden. - Subscription
- Needs an active plan. Otherwise
403 subscription_locked. - Idempotency
- Send an
Idempotency-Keyheader. A retry with the same key does the work once.
Grants the credits for one finished step of the dashboard's getting-started checklist (stepKey). Whether the step is done and the business is eligible is decided again from fresh reads, never from what the caller says. Owner only.
Refusals: not_owner is 403 forbidden; not_done (the step is not finished), already_claimed and not_eligible are 422 validation_error, with the reason in error.details.reason. Credits are granted once per step per business: the grant is guarded by an entry id inside the credit transaction, so a double tap, a second tab or a retry with a new Idempotency-Key answers already_claimed and grants nothing. The same key replays the first answer.
Access: OAuth scope settings:write; owner only (an admin is 403 forbidden); write-gated by the subscription.
merchantOAuth settings:writeAuthorizationBearer <token>OAuth 2.1 (authorization code + PKCE S256, public clients, dynamic registration) for connected AI apps. Effective power is scopes granted AND the person's role today AND the plan. orders:refund, billing:write and team:write are opt-in on the consent screen. Write implies read for marketing:read and messages:read, so a grant holding marketing:write passes a marketing:read check, and messages:send passes messages:read.
Scope: settings:write
storeId*stringA store the person can reach. Any other id answers 404, never 403.
stepKey*stringA step of the dashboard's getting-started checklist that earns credits: details, item:physical, item:service, item:ticketing, item:tour, design, about, payments, share or subscribe. (These are not the keys of getSetupChecklist, which is the AI-app setup order and carries no rewards.) Any other value is 400 bad_request.
"details""item:physical""item:service""item:ticketing""item:tour""design""about""payments""share""subscribe"Idempotency-Key*stringRequired on every write. Minted on the device when the person taps, reused on every retry. A write without one, or with one that does not match the pattern, is refused with 422 validation_error. Scoped to the token's subject, remembered 24 hours. A replay returns the first 2xx response with Idempotent-Replay: true; a request still running answers 409 in_flight; the same key with a different method, path or body answers 409 idempotency_key_reused; non-2xx results are not remembered. If the key store cannot be read nothing is processed and the answer is 503 idempotency_unavailable: retry with the same key.
^[A-Za-z0-9_-]{8,128}$OK
application/json- response
data*curl -X POST 'https://api.shopeazy.co/v1/merchant/stores/<storeId>/setup/rewards/<stepKey>/claim' \ -H 'Authorization: Bearer <access_token>' \ -H 'Idempotency-Key: <unique_key>'{ "data": { "granted": 0, "balance": 0 }}