Spree Commerce Configuration API

openapi: 3.2.0
info:
  title: Admin Configuration API
  contact:
    name: Spree Commerce
    url: https://spreecommerce.org
    email: hello@spreecommerce.org
  description: "Spree Admin API v3 - Administrative API for managing products, orders, and store settings.\n\n## Authentication\n\nThe Admin API requires a secret API key passed in the `x-spree-api-key` header.\nSecret API keys can be generated in the Spree admin dashboard.\n\n## Response Format\n\nAll responses are JSON. List endpoints return paginated responses with `data` and `meta` keys.\nSingle resource endpoints return a flat JSON object.\n\n## Resource IDs\n\nEvery resource is identified by an opaque string ID (e.g. `prod_86Rf07xd4z`,\n`variant_k5nR8xLq`, `or_UkLWZg9DAJ`). Use these IDs everywhere — URL paths,\nrequest bodies, and Ransack filters all accept them directly.\n\n## Error Handling\n\nErrors return a consistent format:\n```json\n{\n  \"error\": {\n    \"code\": \"validation_error\",\n    \"message\": \"Validation failed\",\n    \"details\": { \"name\": [\"can't be blank\"] }\n  }\n}\n```\n"
  version: v3
servers:
- url: http://{defaultHost}
  variables:
    defaultHost:
      default: localhost:3000
tags:
- name: Configuration
  description: Store configuration — payment methods, tag autocomplete
paths:
  /api/v3/admin/admin_users:
    get:
      summary: List staff
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns admin users with at least one role assignment on the current store.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: staff } = await client.adminUsers.list()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '200':
          description: staff found
          content:
            application/json:
              example:
                data:
                - id: admin_UkLWZg9DAJ
                  email: angelic@oconnell.us
                  first_name: Jamal
                  last_name: Doyle
                  full_name: Jamal Doyle
                  created_at: '2026-05-24T17:36:33.885Z'
                  updated_at: '2026-05-24T17:36:33.885Z'
                  roles:
                  - id: role_UkLWZg9DAJ
                    name: admin
                meta:
                  page: 1
                  limit: 25
                  count: 1
                  pages: 1
                  from: 1
                  to: 1
                  in: 1
                  previous: null
                  next: null
  /api/v3/admin/admin_users/{id}:
    get:
      summary: Show a staff member
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: '**Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst staff = await client.adminUsers.get('admin_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: staff member found
          content:
            application/json:
              example:
                id: admin_UkLWZg9DAJ
                email: jess_king@rau.info
                first_name: Mercedez
                last_name: Bailey
                full_name: Mercedez Bailey
                created_at: '2026-05-24T17:36:34.235Z'
                updated_at: '2026-05-24T17:36:34.235Z'
                roles:
                - id: role_UkLWZg9DAJ
                  name: admin
    patch:
      summary: Update a staff member
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Updates name fields and reassigns roles for the current store. `role_ids` is a complete replacement — roles not in the array are removed for this store.


        **Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst staff = await client.adminUsers.update('admin_xxx', {\n  first_name: 'Ada',\n  role_ids: ['role_xxx']\n})"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: staff member updated
          content:
            application/json:
              example:
                id: admin_UkLWZg9DAJ
                email: joesph@grahammarks.ca
                first_name: Renamed
                last_name: Lindgren
                full_name: Renamed Lindgren
                created_at: '2026-05-24T17:36:34.526Z'
                updated_at: '2026-05-24T17:36:34.545Z'
                roles:
                - id: role_UkLWZg9DAJ
                  name: admin
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                first_name:
                  type: string
                  example: Ada
                last_name:
                  type: string
                  example: Lovelace
                role_ids:
                  type: array
                  items:
                    type: string
    delete:
      summary: Remove a staff member from this store
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Removes the user''s role assignments on the current store. The account is preserved — the user keeps access to any other stores.


        **Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nawait client.adminUsers.delete('admin_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: staff removed from store
  /api/v3/admin/api_keys:
    get:
      summary: List API keys
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns publishable and secret API keys for the current store. Secret keys are listed by `token_prefix` only — the plaintext token is delivered exactly once on create.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: keys } = await client.apiKeys.list()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '200':
          description: API keys found
          content:
            application/json:
              example:
                data:
                - id: key_UkLWZg9DAJ
                  name: Storefront key
                  key_type: publishable
                  token_prefix: null
                  scopes: []
                  created_at: '2026-05-24T17:36:34.854Z'
                  updated_at: '2026-05-24T17:36:34.854Z'
                  revoked_at: null
                  last_used_at: null
                  plaintext_token: pk_wqTPmhFDQiJbhbgokeP9tPzK
                  created_by_email: null
                - id: key_gbHJdmfrXB
                  name: Backend integration
                  key_type: secret
                  token_prefix: sk_GAnG4mX7L
                  scopes:
                  - write_all
                  created_at: '2026-05-24T17:36:34.855Z'
                  updated_at: '2026-05-24T17:36:34.855Z'
                  revoked_at: null
                  last_used_at: null
                  plaintext_token: null
                  created_by_email: null
                - id: key_EfhxLZ9ck8
                  name: occaecati
                  key_type: secret
                  token_prefix: sk_Zf75n9zm3
                  scopes:
                  - write_all
                  created_at: '2026-05-24T17:36:34.857Z'
                  updated_at: '2026-05-24T17:36:34.857Z'
                  revoked_at: null
                  last_used_at: null
                  plaintext_token: null
                  created_by_email: null
                meta:
                  page: 1
                  limit: 25
                  count: 3
                  pages: 1
                  from: 1
                  to: 3
                  in: 3
                  previous: null
                  next: null
    post:
      summary: Create an API key
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Creates a publishable or secret API key. The plaintext token is included in the response **once** for secret keys; publishable keys expose their token on every read since they are intended for client-side use.


        **Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.create({\n  name: 'Backend integration',\n  key_type: 'secret',\n  scopes: ['read_orders', 'write_orders']\n})\n// `key.plaintext_token` is available only on this response."
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '201':
          description: secret key created — plaintext token returned once
          content:
            application/json:
              example:
                id: key_VqXmZF31wY
                name: CI key
                key_type: secret
                token_prefix: sk_ryCceerpp
                scopes:
                - read_orders
                created_at: '2026-05-24T17:36:35.441Z'
                updated_at: '2026-05-24T17:36:35.441Z'
                revoked_at: null
                last_used_at: null
                plaintext_token: sk_ryCceerpp5vqodztxueeWXmc
                created_by_email: opal.herzog@cremin.info
        '422':
          description: validation error
          content:
            application/json:
              example:
                error:
                  code: validation_error
                  message: Name can't be blank and Scopes can't be blank
                  details:
                    name:
                    - can't be blank
                    scopes:
                    - can't be blank
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - name
              - key_type
              properties:
                name:
                  type: string
                  example: Backend integration
                key_type:
                  type: string
                  enum:
                  - publishable
                  - secret
                scopes:
                  type: array
                  items:
                    type: string
                  example:
                  - read_orders
                  - write_orders
  /api/v3/admin/api_keys/{id}:
    get:
      summary: Show an API key
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: '**Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.get('key_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: API key found
          content:
            application/json:
              example:
                id: key_UkLWZg9DAJ
                name: Storefront key
                key_type: publishable
                token_prefix: null
                scopes: []
                created_at: '2026-05-24T17:36:35.723Z'
                updated_at: '2026-05-24T17:36:35.723Z'
                revoked_at: null
                last_used_at: null
                plaintext_token: pk_yXJtU7SvnfLbkPvuuiUnKaEo
                created_by_email: null
    delete:
      summary: Delete an API key
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: '**Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nawait client.apiKeys.delete('key_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: API key deleted
  /api/v3/admin/api_keys/{id}/revoke:
    patch:
      summary: Revoke an API key
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Marks the key revoked. Future requests using its token will fail; the row is preserved for audit.


        **Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst key = await client.apiKeys.revoke('key_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: API key revoked
          content:
            application/json:
              example:
                id: key_gbHJdmfrXB
                name: Backend integration
                key_type: secret
                token_prefix: sk_q6euaWxod
                scopes:
                - write_all
                created_at: '2026-05-24T17:36:36.279Z'
                updated_at: '2026-05-24T17:36:36.554Z'
                revoked_at: '2026-05-24T17:36:36.553Z'
                last_used_at: null
                plaintext_token: null
                created_by_email: null
  /api/v3/admin/invitations:
    get:
      summary: List invitations
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns invitations for the current store, including pending and accepted.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: invitations } = await client.invitations.list()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '200':
          description: invitations found
          content:
            application/json:
              example:
                data:
                - id: inv_UkLWZg9DAJ
                  email: eva@hauckwisozk.info
                  status: pending
                  created_at: '2026-05-24T17:37:01.802Z'
                  updated_at: '2026-05-24T17:37:01.802Z'
                  expires_at: '2026-06-07T17:37:01.798Z'
                  role_id: role_UkLWZg9DAJ
                  role_name: admin
                  inviter_email: faith@moore.info
                  acceptance_url: /accept-invitation/inv_UkLWZg9DAJ?token=zySacMBFavnzmtA9ZV4NQdhg
                  invitee_exists: false
                  store:
                    id: store_UkLWZg9DAJ
                    name: Spree Test Store
                meta:
                  page: 1
                  limit: 25
                  count: 1
                  pages: 1
                  from: 1
                  to: 1
                  in: 1
                  previous: null
                  next: null
    post:
      summary: Create an invitation
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Invites a teammate by email. The invitation is scoped to the current store and carries the chosen role; on accept, a `RoleUser` is created via the invitation''s `after_accept` callback.


        **Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst invitation = await client.invitations.create({\n  email: 'ada@example.com',\n  role_id: 'role_xxx'\n})"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '201':
          description: invitation created
          content:
            application/json:
              example:
                id: inv_gbHJdmfrXB
                email: new-staff@example.com
                status: pending
                created_at: '2026-05-24T17:37:02.111Z'
                updated_at: '2026-05-24T17:37:02.111Z'
                expires_at: '2026-06-07T17:37:02.108Z'
                role_id: role_UkLWZg9DAJ
                role_name: admin
                inviter_email: floy_cummerata@haleyvonrueden.com
                acceptance_url: /accept-invitation/inv_gbHJdmfrXB?token=EzFbcPeHADJwGwapUkFjCjut
                invitee_exists: false
                store:
                  id: store_UkLWZg9DAJ
                  name: Spree Test Store
      requestBody:
        content:
          application/json:
            schema:
              type: object
              required:
              - email
              - role_id
              properties:
                email:
                  type: string
                  example: ada@example.com
                role_id:
                  type: string
                  example: role_xxx
  /api/v3/admin/invitations/{id}:
    delete:
      summary: Revoke an invitation
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: '**Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nawait client.invitations.delete('inv_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '204':
          description: invitation revoked
  /api/v3/admin/invitations/{id}/resend:
    patch:
      summary: Resend an invitation
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Issues a fresh token and dispatches the invitation email again.


        **Required scope:** `write_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst invitation = await client.invitations.resend('inv_xxx')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      responses:
        '200':
          description: invitation resent
          content:
            application/json:
              example:
                id: inv_UkLWZg9DAJ
                email: bao.grant@johnsonwitting.com
                status: pending
                created_at: '2026-05-24T17:37:02.736Z'
                updated_at: '2026-05-24T17:37:02.736Z'
                expires_at: '2026-06-07T17:37:02.733Z'
                role_id: role_UkLWZg9DAJ
                role_name: admin
                inviter_email: merlene_cormier@hanepredovic.info
                acceptance_url: /accept-invitation/inv_UkLWZg9DAJ?token=KRTKCjz8LLoWUjxZrWFrAzKU
                invitee_exists: false
                store:
                  id: store_UkLWZg9DAJ
                  name: Spree Test Store
  /api/v3/admin/payment_methods:
    get:
      summary: List payment methods
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns the store''s configured payment methods. Use `source_required: true` to know which methods need a saved source.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: paymentMethods } = await client.paymentMethods.list()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: expand
        in: query
        required: false
        description: Comma-separated associations to expand. Use dot notation for nested expand (max 4 levels).
        schema:
          type: string
      - name: fields
        in: query
        required: false
        description: Comma-separated list of fields to include (e.g., name,type,active). id is always included.
        schema:
          type: string
      responses:
        '200':
          description: payment methods found
          content:
            application/json:
              example:
                data:
                - id: pm_UkLWZg9DAJ
                  name: Check
                  description: null
                  type: check
                  session_required: false
                  source_required: false
                  metadata: {}
                  active: true
                  auto_capture: null
                  storefront_visible: true
                  position: 1
                  created_at: '2026-05-24T17:37:31.151Z'
                  updated_at: '2026-05-24T17:37:31.153Z'
                  preferences: {}
                  preference_schema: []
                meta:
                  page: 1
                  limit: 25
                  count: 1
                  pages: 1
                  from: 1
                  to: 1
                  in: 1
                  previous: null
                  next: null
  /api/v3/admin/payment_methods/types:
    get:
      summary: List available payment provider types
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns the registered Spree::PaymentMethod subclasses that can be used to create new payment methods. Useful for populating a "Provider" dropdown in admin UIs.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: types } = await client.paymentMethods.types()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '200':
          description: provider types found
          content:
            application/json:
              example:
                data:
                - type: bogus
                  label: Bogus
                  description: null
                  preference_schema:
                  - key: dummy_key
                    type: string
                    default: PUBLICKEY123
                  - key: dummy_secret_key
                    type: password
                    default: null
                - type: custom_payment_source_method
                  label: Custom Payment Source Method
                  description: null
                  preference_schema: []
  /api/v3/admin/payment_methods/{id}:
    get:
      summary: Show a payment method
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns a payment method by ID.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst paymentMethod = await client.paymentMethods.get('pm_UkLWZg9DAJ')"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      - name: id
        in: path
        required: true
        schema:
          type: string
      - name: expand
        in: query
        required: false
        description: Comma-separated associations to expand. Use dot notation for nested expand (max 4 levels).
        schema:
          type: string
      - name: fields
        in: query
        required: false
        description: Comma-separated list of fields to include (e.g., name,type,active). id is always included.
        schema:
          type: string
      responses:
        '200':
          description: payment method found
          content:
            application/json:
              example:
                id: pm_UkLWZg9DAJ
                name: Check
                description: null
                type: check
                session_required: false
                source_required: false
                metadata: {}
                active: true
                auto_capture: null
                storefront_visible: true
                position: 1
                created_at: '2026-05-24T17:37:31.752Z'
                updated_at: '2026-05-24T17:37:31.754Z'
                preferences: {}
                preference_schema: []
  /api/v3/admin/roles:
    get:
      summary: List roles
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns the roles available for staff role pickers. Roles are global, not per-store.


        **Required scope:** `read_settings` (for API-key authentication).'
      x-codeSamples:
      - lang: javascript
        label: Spree Admin SDK
        source: "import { createAdminClient } from '@spree/admin-sdk'\n\nconst client = createAdminClient({\n  baseUrl: 'https://your-store.com',\n  secretKey: 'sk_xxx',\n})\n\nconst { data: roles } = await client.roles.list()"
      parameters:
      - name: x-spree-api-key
        in: header
        required: true
        schema:
          type: string
      - name: Authorization
        in: header
        required: true
        schema:
          type: string
      responses:
        '200':
          description: roles found
          content:
            application/json:
              example:
                data:
                - id: role_UkLWZg9DAJ
                  name: admin
                  created_at: '2026-05-24T17:37:45.227Z'
                  updated_at: '2026-05-24T17:37:45.227Z'
                meta:
                  page: 1
                  limit: 25
                  count: 1
                  pages: 1
                  from: 1
                  to: 1
                  in: 1
                  previous: null
                  next: null
  /api/v3/admin/stock_locations:
    get:
      summary: List stock locations
      tags:
      - Configuration
      security:
      - api_key: []
        bearer_auth: []
      description: 'Returns the configured stock locations. Stock locations are global

        (shared across stores). Filter with Ransack predicates such as

        `q[active_eq]`, `q[kind_eq]`, `q[pickup_enabled_eq]`, or

        `q[name_cont]`.


        Pickup-related attributes (`kind`, `pickup_enabled`,

        `pickup_stock_policy`, `pickup_ready_in_minutes`,

        `pickup_instructions`) drive merchant pickup support at checkout —

        customers can collect orders from any active location with

        `pickup_enabled

# --- truncated at 32 KB (68 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/spree-commerce/refs/heads/main/openapi/spree-commerce-configuration-api-openapi.yml